Versioning...

If we end up with a channel that has refcount of zero,
has no msc_data attached and the handler has not returned
1 we will just close it.

openbsc/configure.in

@@ -1,7 +1,6 @@
 dnl Process this file with autoconf to produce a configure script
-AC_INIT
-
-AM_INIT_AUTOMAKE(openbsc, 0.3.99onwaves)
+AC_INIT(openbsc, 0.3.99.15onwaves)
+AM_INIT_AUTOMAKE(AC_PACKAGE_NAME, AC_PACKAGE_VERSION)
 
 dnl kernel style compile messages
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
@@ -16,7 +15,7 @@ dnl checks for libraries
 AC_SEARCH_LIBS(crypt, crypt,
     [LIBCRYPT="-lcrypt"; AC_DEFINE([VTY_CRYPT_PW], [], [Use crypt functionality of vty.])])
 
-PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 0.1.3)
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 0.1.7)
 
 dnl checks for header files
 AC_HEADER_STDC

openbsc/include/openbsc/abis_nm.h

@@ -92,7 +92,7 @@ int abis_nm_sw_act_req_ack(struct gsm_bts *bts, u_int8_t obj_class, u_int8_t i1,
 int abis_nm_raw_msg(struct gsm_bts *bts, int len, u_int8_t *msg);
 int abis_nm_event_reports(struct gsm_bts *bts, int on);
 int abis_nm_reset_resource(struct gsm_bts *bts);
-int abis_nm_software_load(struct gsm_bts *bts, const char *fname,
+int abis_nm_software_load(struct gsm_bts *bts, int trx_nr, const char *fname,
 			  u_int8_t win_size, int forced,
 			  gsm_cbfn *cbfn, void *cb_data);
 int abis_nm_software_load_status(struct gsm_bts *bts);
@@ -148,7 +148,7 @@ int abis_nm_ipaccess_msg(struct gsm_bts *bts, u_int8_t msg_type,
 			 u_int8_t *attr, int attr_len);
 int abis_nm_ipaccess_set_nvattr(struct gsm_bts_trx *trx, u_int8_t *attr,
 				int attr_len);
-int abis_nm_ipaccess_restart(struct gsm_bts *bts);
+int abis_nm_ipaccess_restart(struct gsm_bts_trx *trx);
 int abis_nm_ipaccess_set_attr(struct gsm_bts *bts, u_int8_t obj_class,
 				u_int8_t bts_nr, u_int8_t trx_nr, u_int8_t ts_nr,
 				u_int8_t *attr, u_int8_t attr_len);
@@ -164,7 +164,8 @@ enum nm_evt {
 	EVT_STATECHG_ADM,
 };
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state); 
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_inst);
 
 const char *nm_opstate_name(u_int8_t os);
 const char *nm_avail_name(u_int8_t avail);

openbsc/include/openbsc/bsc_msc.h

@@ -32,16 +32,20 @@ struct bsc_msc_connection {
 	int is_authenticated;
 	const char *ip;
 	int port;
+	int prio;
 
 	void (*connection_loss) (struct bsc_msc_connection *);
 	void (*connected) (struct bsc_msc_connection *);
 	struct timer_list reconnect_timer;
+	struct timer_list timeout_timer;
 };
 
-struct bsc_msc_connection *bsc_msc_create(const char *ip, int port);
+struct bsc_msc_connection *bsc_msc_create(const char *ip, int port, int prio);
 int bsc_msc_connect(struct bsc_msc_connection *);
 void bsc_msc_schedule_connect(struct bsc_msc_connection *);
 
 void bsc_msc_lost(struct bsc_msc_connection *);
 
+struct msgb *bsc_msc_id_get_resp(const char *token);
+
 #endif

openbsc/include/openbsc/bsc_nat.h

@@ -42,6 +42,15 @@
 
 struct bsc_nat;
 
+enum {
+	NAT_CON_TYPE_NONE,
+	NAT_CON_TYPE_LU,
+	NAT_CON_TYPE_CM_SERV_REQ,
+	NAT_CON_TYPE_PAG_RESP,
+	NAT_CON_TYPE_LOCAL_REJECT,
+	NAT_CON_TYPE_OTHER,
+};
+
 /*
  * For the NAT we will need to analyze and later patch
  * the received message. This would require us to parse
@@ -93,6 +102,10 @@ struct bsc_connection {
 	/* a timeout node */
 	struct timer_list id_timeout;
 
+	/* pong timeout */
+	struct timer_list ping_timeout;
+	struct timer_list pong_timeout;
+
 	/* a back pointer */
 	struct bsc_nat *nat;
 };
@@ -110,10 +123,19 @@ struct sccp_connections {
 	struct sccp_source_reference real_ref;
 	struct sccp_source_reference patched_ref;
 	struct sccp_source_reference remote_ref;
+	int has_remote_ref;
+
+	/* status */
+	int con_type;
+	int con_local;
 
 	/* GSM audio handling. That is 32 * multiplex + ts */
+	int crcx;
 	int msc_timeslot;
 	int bsc_timeslot;
+
+	/* timeout handling */
+	struct timespec creation_time;
 };
 
 /**
@@ -140,11 +162,12 @@ struct bsc_config {
 	unsigned int lac;
 	int nr;
 
+	char *description;
+
 	/* imsi white and blacklist */
-	char *imsi_allow;
-	regex_t imsi_allow_re;
-	char *imsi_deny;
-	regex_t imsi_deny_re;
+	char *acc_lst_name;
+
+	int forbid_paging;
 
 	/* backpointer */
 	struct bsc_nat *nat;
@@ -160,8 +183,6 @@ struct bsc_endpoint {
 	char *transaction_id;
 	/* the bsc we are talking to */
 	struct bsc_connection *bsc;
-	/* pending delete */
-	int pending_delete;
 };
 
 /**
@@ -183,6 +204,24 @@ struct bsc_nat_statistics {
 	} msc;
 };
 
+struct bsc_nat_acc_lst {
+	struct llist_head list;
+
+	/* the name of the list */
+	const char *name;
+	struct llist_head fltr_list;
+};
+
+struct bsc_nat_acc_lst_entry {
+	struct llist_head list;
+
+	/* the filter */
+	char *imsi_allow;
+	regex_t imsi_allow_re;
+	char *imsi_deny;
+	regex_t imsi_deny_re;
+};
+
 /**
  * the structure of the "nat" network
  */
@@ -193,9 +232,13 @@ struct bsc_nat {
 	/* active BSC connections that need patching */
 	struct llist_head bsc_connections;
 
+	/* access lists */
+	struct llist_head access_lists;
+
 	/* known BSC's */
 	struct llist_head bsc_configs;
 	int num_bsc;
+	int bsc_ip_tos;
 
 	/* MGCP config */
 	struct mgcp_config *mgcp_cfg;
@@ -207,14 +250,18 @@ struct bsc_nat {
 	char *msc_ip;
 	int msc_port;
 	int first_contact;
+	struct bsc_msc_connection *msc_con;
+	char *token;
+
+	/* timeouts */
+	int auth_timeout;
+	int ping_timeout;
+	int pong_timeout;
 
 	struct bsc_endpoint *bsc_endpoints;
 
 	/* filter */
-	char *imsi_allow;
-	regex_t imsi_allow_re;
-	char *imsi_deny;
-	regex_t imsi_deny_re;
+	char *acc_lst_name;
 
 	/* statistics */
 	struct bsc_nat_statistics stats;
@@ -228,6 +275,9 @@ struct bsc_connection *bsc_connection_alloc(struct bsc_nat *nat);
 void bsc_nat_set_msc_ip(struct bsc_nat *bsc, const char *ip);
 
 void sccp_connection_destroy(struct sccp_connections *);
+void bsc_close_connection(struct bsc_connection *);
+
+const char *bsc_con_type_to_string(int type);
 
 /**
  * parse the given message into the above structure
@@ -241,24 +291,30 @@ int bsc_nat_filter_ipa(int direction, struct msgb *msg, struct bsc_nat_parsed *p
 int bsc_nat_vty_init(struct bsc_nat *nat);
 struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg, int *_lac);
 
+/**
+ * Content filtering.
+ */
+int bsc_nat_filter_sccp_cr(struct bsc_connection *bsc, struct msgb *msg,
+			   struct bsc_nat_parsed *, int *con_type);
+
 /**
  * SCCP patching and handling
  */
-int create_sccp_src_ref(struct bsc_connection *bsc, struct msgb *msg, struct bsc_nat_parsed *parsed);
+struct sccp_connections *create_sccp_src_ref(struct bsc_connection *bsc, struct bsc_nat_parsed *parsed);
 int update_sccp_src_ref(struct sccp_connections *sccp, struct bsc_nat_parsed *parsed);
 void remove_sccp_src_ref(struct bsc_connection *bsc, struct msgb *msg, struct bsc_nat_parsed *parsed);
 struct sccp_connections *patch_sccp_src_ref_to_bsc(struct msgb *, struct bsc_nat_parsed *, struct bsc_nat *);
-struct sccp_connections *patch_sccp_src_ref_to_msc(struct msgb *, struct bsc_nat_parsed *, struct bsc_nat *);
+struct sccp_connections *patch_sccp_src_ref_to_msc(struct msgb *, struct bsc_nat_parsed *, struct bsc_connection *);
 
 /**
  * MGCP/Audio handling
  */
 int bsc_write_mgcp(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length);
 int bsc_mgcp_assign(struct sccp_connections *, struct msgb *msg);
-void bsc_mgcp_clear(struct sccp_connections *);
-void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int);
+void bsc_mgcp_init(struct sccp_connections *);
+void bsc_mgcp_dlcx(struct sccp_connections *);
 void bsc_mgcp_free_endpoints(struct bsc_nat *nat);
-int bsc_mgcp_init(struct bsc_nat *nat);
+int bsc_mgcp_nat_init(struct bsc_nat *nat);
 
 struct sccp_connections *bsc_mgcp_find_con(struct bsc_nat *, int endpoint_number);
 struct msgb *bsc_mgcp_rewrite(char *input, int length, const char *ip, int port);
@@ -271,4 +327,12 @@ int bsc_mgcp_extract_ci(const char *resp);
 
 int bsc_write(struct bsc_connection *bsc, struct msgb *msg, int id);
 
+/* IMSI allow/deny handling */
+void bsc_parse_reg(void *ctx, regex_t *reg, char **imsi, int argc, const char **argv);
+struct bsc_nat_acc_lst *bsc_nat_acc_lst_find(struct bsc_nat *nat, const char *name);
+struct bsc_nat_acc_lst *bsc_nat_acc_lst_get(struct bsc_nat *nat, const char *name);
+void bsc_nat_acc_lst_delete(struct bsc_nat_acc_lst *lst);
+
+struct bsc_nat_acc_lst_entry *bsc_nat_acc_lst_entry_create(struct bsc_nat_acc_lst *);
+
 #endif

openbsc/include/openbsc/e1_input.h

@@ -66,6 +66,8 @@ struct e1inp_ts {
 		struct {
 			/* list of all signalling links on this TS */
 			struct llist_head sign_links;
+			/* delay for the queue */
+			int delay;
 			/* timer when to dequeue next frame */
 			struct timer_list tx_timer;
 		} sign;
@@ -93,6 +95,7 @@ struct e1inp_driver {
 	struct llist_head list;
 	const char *name;
 	int (*want_write)(struct e1inp_ts *ts);
+	int default_delay;
 };	
 
 struct e1inp_line {

openbsc/include/openbsc/gsm_04_08.h

@@ -45,12 +45,15 @@ int decode_bcd_number(char *output, int output_len, const u_int8_t *bcd_lv,
 		      int h_len);
 
 int send_siemens_mrpci(struct gsm_lchan *lchan, u_int8_t *classmark2_lv);
-int gsm48_paging_extract_mi(struct msgb *msg, char *mi_string, u_int8_t *mi_type);
+int gsm48_extract_mi(uint8_t *classmark2, int length, char *mi_string, uint8_t *mi_type);
+int gsm48_paging_extract_mi(struct gsm48_pag_resp *pag, int length, char *mi_string, u_int8_t *mi_type);
 int gsm48_handle_paging_resp(struct msgb *msg, struct gsm_subscriber *subscr);
 
 int gsm48_lchan_modify(struct gsm_lchan *lchan, u_int8_t lchan_mode);
 int gsm48_rx_rr_modif_ack(struct msgb *msg);
 int gsm48_parse_meas_rep(struct gsm_meas_rep *rep, struct msgb *msg);
 
+struct msgb *gsm48_create_mm_serv_rej(enum gsm48_reject_value value);
+struct msgb *gsm48_create_loc_upd_rej(uint8_t cause);
 
 #endif

openbsc/include/openbsc/gsm_data.h

@@ -3,6 +3,8 @@
 
 #include <sys/types.h>
 
+struct bsc_msc_connection;
+
 enum gsm_phys_chan_config {
 	GSM_PCHAN_NONE,
 	GSM_PCHAN_CCCH,
@@ -85,11 +87,6 @@ typedef int gsm_cbfn(unsigned int hooknum,
 		     struct msgb *msg,
 		     void *data, void *param);
 
-/* communications link with a BTS */
-struct gsm_bts_link {
-	struct gsm_bts *bts;
-};
-
 struct sccp_connection;
 
 /* Real authentication information containing Ki */
@@ -132,6 +129,7 @@ struct bss_sccp_connection_data {
         struct timer_list T10;
 
 	/* for SCCP ... */
+	struct timer_list sccp_cc_timeout;
 	struct timer_list sccp_it;
 
 	/* audio handling */
@@ -290,6 +288,9 @@ struct gsm_lchan {
 
 	/* release reason */
 	u_int8_t release_reason;
+
+	/* timestamp */
+	struct timeval alloc_time;
 };
 
 struct gsm_e1_subslot {
@@ -517,10 +518,12 @@ struct gsm_bts {
 		struct {
 			struct gsm_nm_state nm_state;
 			u_int16_t nsei;
+			uint8_t timer[7];
 		} nse;
 		struct {
 			struct gsm_nm_state nm_state;
 			u_int16_t bvci;
+			uint8_t timer[11];
 		} cell;
 		struct gsm_bts_gprs_nsvc nsvc[2];
 		u_int8_t rac;
@@ -677,6 +680,10 @@ struct gsm_network {
 	char *bsc_token;
 	char *msc_ip;
 	int msc_port;
+	int msc_prio;
+	struct bsc_msc_connection *msc_con;
+	int ping_timeout;
+	int pong_timeout;
 };
 
 #define SMS_HDR_SIZE	128
@@ -778,14 +785,6 @@ const char *bts_gprs_mode_name(enum bts_gprs_mode mode);
 
 void gsm_trx_lock_rf(struct gsm_bts_trx *trx, int locked);
 
-/* A parsed GPRS routing area */
-struct gprs_ra_id {
-	u_int16_t	mnc;
-	u_int16_t	mcc;
-	u_int16_t	lac;
-	u_int8_t	rac;
-};
-
 int gsm48_ra_id_by_bts(u_int8_t *buf, struct gsm_bts *bts);
 void gprs_ra_id_by_bts(struct gprs_ra_id *raid, struct gsm_bts *bts);
 struct gsm_meas_rep *lchan_next_meas_rep(struct gsm_lchan *lchan);

openbsc/include/openbsc/mgcp.h

@@ -93,6 +93,7 @@ struct mgcp_config {
 	int audio_loop;
 	int early_bind;
 	int rtp_base_port;
+	int endp_tos;
 
 	/* only used in forward mode */
 	char *forward_ip;

openbsc/include/openbsc/mgcp_internal.h

@@ -73,5 +73,6 @@ struct mgcp_msg_ptr {
 int mgcp_analyze_header(struct mgcp_config *cfg, struct msgb *msg,
 			struct mgcp_msg_ptr *ptr, int size,
 			const char **transaction_id, struct mgcp_endpoint **endp);
+int mgcp_send_dummy(struct mgcp_endpoint *endp);
 
 #endif

openbsc/include/openbsc/signal.h

@@ -133,7 +133,7 @@ struct scall_signal_data {
 };
 
 struct ipacc_ack_signal_data {
-	struct gsm_bts *bts;
+	struct gsm_bts_trx *trx;
 	u_int8_t msg_type;	
 };
 

openbsc/include/sccp/sccp.h

@@ -148,6 +148,11 @@ extern const struct sockaddr_sccp sccp_ssn_bssap;
 u_int32_t sccp_src_ref_to_int(struct sccp_source_reference *ref);
 struct sccp_source_reference sccp_src_ref_from_int(u_int32_t);
 
+struct msgb *sccp_create_refuse(struct sccp_source_reference *src_ref, int cause, uint8_t *data, int length);
+struct msgb *sccp_create_cc(struct sccp_source_reference *src_ref, struct sccp_source_reference *dst_ref);
+struct msgb *sccp_create_rlsd(struct sccp_source_reference *src_ref, struct sccp_source_reference *dst_ref, int cause);
+struct msgb *sccp_create_dt1(struct sccp_source_reference *dst_ref, uint8_t *data, uint8_t len);
+
 /**
  * Below this are helper functions and structs for parsing SCCP messages
  */

openbsc/include/sccp/sccp_types.h

@@ -411,4 +411,10 @@ struct sccp_data_it {
 	u_int8_t			credit;
 } __attribute__((packed));
 
+struct sccp_proto_err {
+	u_int8_t			type;
+	struct sccp_source_reference	destination_local_reference;
+	u_int8_t			error_cause;
+};
+
 #endif

openbsc/include/vty/buffer.h

@@ -28,7 +28,7 @@
 /* Create a new buffer.  Memory will be allocated in chunks of the given
    size.  If the argument is 0, the library will supply a reasonable
    default size suitable for buffering socket I/O. */
-struct buffer *buffer_new(size_t);
+struct buffer *buffer_new(void *ctx, size_t);
 
 /* Free all data in the buffer. */
 void buffer_reset(struct buffer *);

openbsc/src/Makefile.am

@@ -56,4 +56,4 @@ bsc_nat_SOURCES = nat/bsc_nat.c nat/bsc_filter.c nat/bsc_sccp.c \
 		  nat/bsc_nat_utils.c nat/bsc_nat_vty.c nat/bsc_mgcp_utils.c \
 		  mgcp/mgcp_protocol.c mgcp/mgcp_network.c mgcp/mgcp_vty.c \
 		  bsc_msc.c bssap.c
-bsc_nat_LDADD = libvty.a libbsc.a libsccp.a
+bsc_nat_LDADD = libvty.a libbsc.a libsccp.a -lrt

openbsc/src/abis_nm.c

@@ -678,7 +678,7 @@ static int update_admstate(struct gsm_bts *bts, u_int8_t obj_class,
 	new_state = *nm_state;
 	new_state.administrative = adm_state;
 
-	rc = nm_state_event(EVT_STATECHG_ADM, obj_class, obj, nm_state, &new_state);
+	rc = nm_state_event(EVT_STATECHG_ADM, obj_class, obj, nm_state, &new_state, obj_inst);
 
 	nm_state->administrative = adm_state;
 
@@ -732,7 +732,7 @@ static int abis_nm_rx_statechg_rep(struct msgb *mb)
 		/* Update the operational state of a given object in our in-memory data
  		* structures and send an event to the higher layer */
 		void *obj = objclass2obj(bts, foh->obj_class, &foh->obj_inst);
-		rc = nm_state_event(EVT_STATECHG_OPER, foh->obj_class, obj, nm_state, &new_state);
+		rc = nm_state_event(EVT_STATECHG_OPER, foh->obj_class, obj, nm_state, &new_state, &foh->obj_inst);
 		nm_state->operational = new_state.operational;
 		nm_state->availability = new_state.availability;
 		if (nm_state->administrative == 0)
@@ -1139,6 +1139,7 @@ enum sw_state {
 
 struct abis_nm_sw {
 	struct gsm_bts *bts;
+	int trx_nr;
 	gsm_cbfn *cbfn;
 	void *cb_data;
 	int forced;
@@ -1592,7 +1593,7 @@ static int abis_nm_rcvmsg_sw(struct msgb *mb)
 }
 
 /* Load the specified software into the BTS */
-int abis_nm_software_load(struct gsm_bts *bts, const char *fname,
+int abis_nm_software_load(struct gsm_bts *bts, int trx_nr, const char *fname,
 			  u_int8_t win_size, int forced,
 			  gsm_cbfn *cbfn, void *cb_data)
 {
@@ -1606,6 +1607,7 @@ int abis_nm_software_load(struct gsm_bts *bts, const char *fname,
 		return -EBUSY;
 
 	sw->bts = bts;
+	sw->trx_nr = trx_nr;
 
 	switch (bts->type) {
 	case GSM_BTS_TYPE_BS11:
@@ -1616,8 +1618,8 @@ int abis_nm_software_load(struct gsm_bts *bts, const char *fname,
 		break;
 	case GSM_BTS_TYPE_NANOBTS:
 		sw->obj_class = NM_OC_BASEB_TRANSC;
-		sw->obj_instance[0] = 0x00;
-		sw->obj_instance[1] = 0x00;
+		sw->obj_instance[0] = sw->bts->nr;
+		sw->obj_instance[1] = sw->trx_nr;
 		sw->obj_instance[2] = 0xff;
 		break;
 	case GSM_BTS_TYPE_UNKNOWN:
@@ -2551,7 +2553,7 @@ static int bs11_swload_cbfn(unsigned int hook, unsigned int event,
 		fle = fl_dequeue(&bs11_sw->file_list);
 		if (fle) {
 			/* start download the next file of our file list */
-			rc = abis_nm_software_load(bs11_sw->bts, fle->fname,
+			rc = abis_nm_software_load(bs11_sw->bts, 0xff, fle->fname,
 						   bs11_sw->win_size,
 						   bs11_sw->forced,
 						   &bs11_swload_cbfn, bs11_sw);
@@ -2607,7 +2609,7 @@ int abis_nm_bs11_load_swl(struct gsm_bts *bts, const char *fname,
 		return -EINVAL;
 
 	/* start download the next file of our file list */
-	rc = abis_nm_software_load(bts, fle->fname, win_size, forced,
+	rc = abis_nm_software_load(bts, 0xff, fle->fname, win_size, forced,
 				   bs11_swload_cbfn, bs11_sw);
 	talloc_free(fle);
 	return rc;
@@ -2775,12 +2777,12 @@ static int abis_nm_rx_ipacc(struct msgb *msg)
 	case NM_MT_IPACC_RSL_CONNECT_NACK:
 	case NM_MT_IPACC_SET_NVATTR_NACK:
 	case NM_MT_IPACC_GET_NVATTR_NACK:
-		signal.bts = msg->trx->bts;
+		signal.trx = gsm_bts_trx_by_nr(msg->trx->bts, foh->obj_inst.trx_nr);
 		signal.msg_type = foh->msg_type;
 		dispatch_signal(SS_NM, S_NM_IPACC_NACK, &signal);
 		break;
 	case NM_MT_IPACC_SET_NVATTR_ACK:
-		signal.bts = msg->trx->bts;
+		signal.trx = gsm_bts_trx_by_nr(msg->trx->bts, foh->obj_inst.trx_nr);
 		signal.msg_type = foh->msg_type;
 		dispatch_signal(SS_NM, S_NM_IPACC_ACK, &signal);
 		break;
@@ -2866,9 +2868,16 @@ int abis_nm_ipaccess_rsl_connect(struct gsm_bts_trx *trx,
 }
 
 /* restart / reboot an ip.access nanoBTS */
-int abis_nm_ipaccess_restart(struct gsm_bts *bts)
+int abis_nm_ipaccess_restart(struct gsm_bts_trx *trx)
 {
-	return __simple_cmd(bts, NM_MT_IPACC_RESTART);
+	struct abis_om_hdr *oh;
+	struct msgb *msg = nm_msgb_alloc();
+
+	oh = (struct abis_om_hdr *) msgb_put(msg, ABIS_OM_FOM_HDR_SIZE);
+	fill_om_fom_hdr(oh, 0, NM_MT_IPACC_RESTART, NM_OC_BASEB_TRANSC,
+			trx->bts->nr, trx->nr, 0xff);
+
+	return abis_nm_sendmsg(trx->bts, msg);
 }
 
 int abis_nm_ipaccess_set_attr(struct gsm_bts *bts, u_int8_t obj_class,

openbsc/src/abis_rsl.c

@@ -911,7 +911,7 @@ static int rsl_rx_meas_res(struct msgb *msg)
 	/* check if this channel is actually active */
 	/* FIXME: maybe this check should be way more generic/centralized */
 	if (msg->lchan->state != LCHAN_S_ACTIVE) {
-		LOGP(DRSL, LOGL_NOTICE, "%s: MEAS RES for inactive channel\n",
+		LOGP(DRSL, LOGL_DEBUG, "%s: MEAS RES for inactive channel\n",
 			gsm_lchan_name(msg->lchan));
 		return 0;
 	}

openbsc/src/bs11_config.c

@@ -481,7 +481,7 @@ static int handle_state_resp(enum abis_bs11_phase state)
 		 * argument, so our swload_cbfn can distinguish
 		 * a safety load from a regular software */
 		if (file_is_readable(fname_safety))
-			rc = abis_nm_software_load(g_bts, fname_safety,
+			rc = abis_nm_software_load(g_bts, 0xff, fname_safety,
 						   win_size, param_forced,
 						   swload_cbfn, g_bts);
 		else
@@ -697,7 +697,8 @@ int handle_serial_msg(struct msgb *rx_msg)
 }
 
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state)
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_ins)
 {
 	return 0;
 }

openbsc/src/bsc_init.c

@@ -317,14 +317,14 @@ static unsigned char bs11_attr_radio[] =
 static unsigned char nanobts_attr_bts[] = {
 	NM_ATT_INTERF_BOUND, 0x55, 0x5b, 0x61, 0x67, 0x6d, 0x73,
 	/* interference avg. period in numbers of SACCH multifr */
-	NM_ATT_INTAVE_PARAM, 0x06,
+	NM_ATT_INTAVE_PARAM, 0x1f,
 	/* conn fail based on SACCH error rate */
-	NM_ATT_CONN_FAIL_CRIT, 0x00, 0x02, 0x01, 0x10,
-	NM_ATT_T200, 0x1e, 0x24, 0x24, 0xa8, 0x34, 0x21, 0xa8,
-	NM_ATT_MAX_TA, 0x3f,
-	NM_ATT_OVERL_PERIOD, 0x00, 0x01, 10, /* seconds */
-	NM_ATT_CCCH_L_T, 10, /* percent */
-	NM_ATT_CCCH_L_I_P, 1, /* seconds */
+	NM_ATT_CONN_FAIL_CRIT, 0x00, 0x02, 0x01, 0x20,
+	NM_ATT_T200, 0x1e, 0x1e, 0x24, 0xa8, 0x34, 0x21, 0xa8,
+	NM_ATT_MAX_TA, 0x00,
+	NM_ATT_OVERL_PERIOD, 0x00, 0x01, 5, /* seconds */
+	NM_ATT_CCCH_L_T, 32, /* percent */
+	NM_ATT_CCCH_L_I_P, 5, /* seconds */
 	NM_ATT_RACH_B_THRESH, 10, /* busy threshold in - dBm */
 	NM_ATT_LDAVG_SLOTS, 0x03, 0xe8, /* rach load averaging 1000 slots */
 	NM_ATT_BTS_AIR_TIMER, 128, /* miliseconds */
@@ -345,7 +345,7 @@ static unsigned char nanobts_attr_nse[] = {
 				    3,  /* (un)blocking retries */
 				    3,  /* reset timer (Tns-reset) */
 				    3,  /* reset retries */
-				    30,  /* test timer (Tns-test) */
+				    3,  /* test timer (Tns-test) */
 				    3,  /* alive timer (Tns-alive) */
 				    10, /* alive retrires */
 	NM_ATT_IPACC_BSSGP_CFG, 0, 11,
@@ -366,29 +366,27 @@ static unsigned char nanobts_attr_cell[] = {
 	NM_ATT_IPACC_RAC, 0, 1,  1, /* routing area code */
 	NM_ATT_IPACC_GPRS_PAGING_CFG, 0, 2,
 		5,	/* repeat time (50ms) */
-		3,	/* repeat count */
+		1,	/* repeat count */
 	NM_ATT_IPACC_BVCI, 0, 2,  0x03, 0x9d, /* BVCI 925 */
 	NM_ATT_IPACC_RLC_CFG, 0, 9,
-		20, 	/* T3142 */
-		5, 	/* T3169 */
-		5,	/* T3191 */
-		200,	/* T3193 */
-		5,	/* T3195 */
-		10,	/* N3101 */
-		4,	/* N3103 */
-		8,	/* N3105 */
-		15,	/* RLC CV countdown */
-	NM_ATT_IPACC_CODING_SCHEMES, 0, 2,  0x0f, 0x00,	/* CS1..CS4 */
+		0x14, 	/* T3142 */
+		0x05, 	/* T3169 */
+		0x05,	/* T3191 */
+		0x14,	/* T3193 */
+		0x05,	/* T3195 */
+		0x0a,	/* N3101 */
+		0x04,	/* N3103 */
+		0x08,	/* N3105 */
+		0x0f,	/* RLC CV countdown */
+	NM_ATT_IPACC_CODING_SCHEMES, 0, 2,  0x8f, 0xff,	/* CS1..CS4 */
 	NM_ATT_IPACC_RLC_CFG_2, 0, 5,
-		0x00, 250,	/* T downlink TBF extension (0..500) */
-		0x00, 250,	/* T uplink TBF extension (0..500) */
+		0x00, 0x96,	/* T downlink TBF extension (0..500) */
+		0x00, 0x32,	/* T uplink TBF extension (0..500) */
 		2,	/* CS2 */
-#if 0
 	/* EDGE model only, breaks older models.
 	 * Should inquire the BTS capabilities */
 	NM_ATT_IPACC_RLC_CFG_3, 0, 1,
 		2,	/* MCS2 */
-#endif
 };
 
 static unsigned char nanobts_attr_nsvc0[] = {
@@ -401,7 +399,8 @@ static unsigned char nanobts_attr_nsvc0[] = {
 
 /* Callback function to be called whenever we get a GSM 12.21 state change event */
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state)
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_inst)
 {
 	struct gsm_bts *bts;
 	struct gsm_bts_trx *trx;
@@ -418,16 +417,15 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 	switch (obj_class) {
 	case NM_OC_SITE_MANAGER:
 		bts = container_of(obj, struct gsm_bts, site_mgr);
-		if ((new_state->operational == 2 &&
+		if ((new_state->operational == NM_OPSTATE_ENABLED &&
 		     new_state->availability == NM_AVSTATE_OK) ||
-		    (new_state->operational == 1 &&
+		    (new_state->operational == NM_OPSTATE_DISABLED &&
 		     new_state->availability == NM_AVSTATE_OFF_LINE))
 			abis_nm_opstart(bts, obj_class, 0xff, 0xff, 0xff);
 		break;
 	case NM_OC_BTS:
 		bts = obj;
 		if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
-			printf("STARTING BTS...\n");
 			patch_nm_tables(bts);
 			abis_nm_set_bts_attr(bts, nanobts_attr_bts,
 					     sizeof(nanobts_attr_bts));
@@ -441,9 +439,8 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 	case NM_OC_CHANNEL:
 		ts = obj;
 		trx = ts->trx;
-		if (new_state->operational == 1 &&
+		if (new_state->operational == NM_OPSTATE_DISABLED &&
 		    new_state->availability == NM_AVSTATE_DEPENDENCY) {
-			printf("STARTING OC Channel...\n");
 			patch_nm_tables(trx->bts);
 			enum abis_nm_chan_comb ccomb =
 						abis_nm_chcomb4pchan(ts->pchan);
@@ -457,7 +454,7 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 		break;
 	case NM_OC_RADIO_CARRIER:
 		trx = obj;
-		if (new_state->operational == 1 &&
+		if (new_state->operational == NM_OPSTATE_DISABLED &&
 		    new_state->availability == NM_AVSTATE_OK)
 			abis_nm_opstart(trx->bts, obj_class, trx->bts->bts_nr,
 					trx->nr, 0xff);
@@ -466,7 +463,7 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 		bts = container_of(obj, struct gsm_bts, gprs.nse);
 		if (bts->gprs.mode == BTS_GPRS_NONE)
 			break;
-		if (new_state->availability == 5) {
+		if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
 			abis_nm_ipaccess_set_attr(bts, obj_class, bts->bts_nr,
 						  0xff, 0xff, nanobts_attr_nse,
 						  sizeof(nanobts_attr_nse));
@@ -480,7 +477,7 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 		bts = container_of(obj, struct gsm_bts, gprs.cell);
 		if (bts->gprs.mode == BTS_GPRS_NONE)
 			break;
-		if (new_state->availability == 5) {
+		if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
 			abis_nm_ipaccess_set_attr(bts, obj_class, bts->bts_nr,
 						  0, 0xff, nanobts_attr_cell,
 						  sizeof(nanobts_attr_cell));
@@ -495,7 +492,7 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 		bts = nsvc->bts;
 		if (bts->gprs.mode == BTS_GPRS_NONE)
 			break;
-	        /* We skip NSVC1 since we only use NSVC0 */
+		/* We skip NSVC1 since we only use NSVC0 */
 		if (nsvc->id == 1)
 			break;
 		if (new_state->availability == NM_AVSTATE_OFF_LINE) {
@@ -885,6 +882,10 @@ static void patch_nm_tables(struct gsm_bts *bts)
 	/* patch NSEI */
 	nanobts_attr_nse[3] = bts->gprs.nse.nsei >> 8;
 	nanobts_attr_nse[4] = bts->gprs.nse.nsei & 0xff;
+	memcpy(nanobts_attr_nse+8, bts->gprs.nse.timer,
+		ARRAY_SIZE(bts->gprs.nse.timer));
+	memcpy(nanobts_attr_nse+18, bts->gprs.cell.timer,
+		ARRAY_SIZE(bts->gprs.cell.timer));
 
 	/* patch NSVCI */
 	nanobts_attr_nsvc0[3] = bts->gprs.nsvc[0].nsvci >> 8;
@@ -976,6 +977,8 @@ void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx)
 
 static int bootstrap_bts(struct gsm_bts *bts)
 {
+	int i, n;
+
 	switch (bts->band) {
 	case GSM_BAND_1800:
 		if (bts->c0->arfcn < 512 || bts->c0->arfcn > 885) {
@@ -1012,10 +1015,34 @@ static int bootstrap_bts(struct gsm_bts *bts)
 
 	/* Control Channel Description */
 	bts->si_common.chan_desc.att = 1;
-	bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_1_C;
 	bts->si_common.chan_desc.bs_pa_mfrms = RSL_BS_PA_MFRMS_5;
 	/* T3212 is set from vty/config */
 
+	/* Set ccch config by looking at ts config */
+	for (n=0, i=0; i<8; i++)
+		n += bts->c0->ts[i].pchan == GSM_PCHAN_CCCH ? 1 : 0;
+
+	switch (n) {
+	case 0:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_1_C;
+		break;
+	case 1:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_1_NC;
+		break;
+	case 2:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_2_NC;
+		break;
+	case 3:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_3_NC;
+		break;
+	case 4:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_4_NC;
+		break;
+	default:
+		LOGP(DNM, LOGL_ERROR, "Unsupported CCCH timeslot configuration\n");
+		return -EINVAL;
+	}
+
 	/* some defaults for our system information */
 	bts->si_common.cell_options.radio_link_timeout = 2; /* 12 */
 	bts->si_common.cell_options.dtx = 2; /* MS shall not use upplink DTX */

openbsc/src/bsc_msc.c

@@ -22,6 +22,7 @@
 
 #include <openbsc/bsc_msc.h>
 #include <openbsc/debug.h>
+#include <openbsc/ipaccess.h>
 
 #include <osmocore/write_queue.h>
 #include <osmocore/talloc.h>
@@ -49,6 +50,14 @@ static void connection_loss(struct bsc_msc_connection *con)
 	con->connection_loss(con);
 }
 
+static void msc_con_timeout(void *_con)
+{
+	struct bsc_msc_connection *con = _con;
+
+	LOGP(DMSC, LOGL_ERROR, "MSC Connection timeout.\n");
+	bsc_msc_lost(con);
+}
+
 static int bsc_msc_except(struct bsc_fd *bfd)
 {
 	struct write_queue *wrt;
@@ -98,6 +107,7 @@ static int msc_connection_connect(struct bsc_fd *fd, unsigned int what)
 	fd->when = BSC_FD_READ | BSC_FD_EXCEPT;
 
 	con->is_connected = 1;
+	bsc_del_timer(&con->timeout_timer);
 	LOGP(DMSC, LOGL_NOTICE, "(Re)Connected to the MSC.\n");
 	if (con->connected)
 		con->connected(con);
@@ -153,6 +163,13 @@ int bsc_msc_connect(struct bsc_msc_connection *con)
 	/* make it non blocking */
 	setnonblocking(fd);
 
+	/* set the socket priority */
+	ret = setsockopt(fd->fd, IPPROTO_IP, IP_TOS,
+			 &con->prio, sizeof(con->prio));
+	if (ret != 0)
+		LOGP(DMSC, LOGL_ERROR, "Failed to set prio to %d. %s\n",
+		     con->prio, strerror(errno));
+
 	memset(&sin, 0, sizeof(sin));
 	sin.sin_family = AF_INET;
 	sin.sin_port = htons(con->port);
@@ -165,6 +182,9 @@ int bsc_msc_connect(struct bsc_msc_connection *con)
 		LOGP(DMSC, LOGL_ERROR, "MSC Connection in progress\n");
 		fd->when = BSC_FD_WRITE;
 		fd->cb = msc_connection_connect;
+		con->timeout_timer.cb = msc_con_timeout;
+		con->timeout_timer.data = con;
+		bsc_schedule_timer(&con->timeout_timer, 20, 0);
 	} else if (ret < 0) {
 		perror("Connection failed");
 		connection_loss(con);
@@ -188,7 +208,7 @@ int bsc_msc_connect(struct bsc_msc_connection *con)
 }
 
 
-struct bsc_msc_connection *bsc_msc_create(const char *ip, int port)
+struct bsc_msc_connection *bsc_msc_create(const char *ip, int port, int prio)
 {
 	struct bsc_msc_connection *con;
 
@@ -200,6 +220,7 @@ struct bsc_msc_connection *bsc_msc_create(const char *ip, int port)
 
 	con->ip = ip;
 	con->port = port;
+	con->prio = prio;
 	write_queue_init(&con->write_queue, 100);
 	con->write_queue.except_cb = bsc_msc_except;
 	return con;
@@ -227,3 +248,24 @@ void bsc_msc_schedule_connect(struct bsc_msc_connection *con)
 	con->reconnect_timer.data = con;
 	bsc_schedule_timer(&con->reconnect_timer, 5, 0);
 }
+
+struct msgb *bsc_msc_id_get_resp(const char *token)
+{
+	struct msgb *msg;
+
+	if (!token) {
+		LOGP(DMSC, LOGL_ERROR, "No token specified.\n");
+		return NULL;
+	}
+
+	msg = msgb_alloc_headroom(4096, 128, "id resp");
+	if (!msg) {
+		LOGP(DMSC, LOGL_ERROR, "Failed to create the message.\n");
+		return NULL;
+	}
+
+	msg->l2h = msgb_v_put(msg, IPAC_MSGT_ID_RESP);
+	msgb_l16tv_put(msg, strlen(token) + 1,
+			IPAC_IDTAG_UNITNAME, (u_int8_t *) token);
+	return msg;
+}

openbsc/src/bsc_msc_ip.c

@@ -30,6 +30,7 @@
 
 #include <sys/socket.h>
 #include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <arpa/inet.h>
 
 #define _GNU_SOURCE
@@ -49,6 +50,7 @@
 #include <osmocore/select.h>
 #include <osmocore/talloc.h>
 #include <osmocore/write_queue.h>
+#include <osmocore/gsm0808.h>
 
 #include <sccp/sccp.h>
 
@@ -60,22 +62,38 @@ static struct log_target *stderr_target;
 struct gsm_network *bsc_gsmnet = 0;
 static const char *config_file = "openbsc.cfg";
 static char *msc_address = NULL;
-static struct bsc_msc_connection *msc_con;
 static struct in_addr local_addr;
 static LLIST_HEAD(active_connections);
 static struct write_queue mgcp_agent;
 static const char *rf_ctl = NULL;
+static int testmode = 0;
 extern int ipacc_rtp_direct;
 
+/* msc handling */
+static struct timer_list msc_ping_timeout;
+static struct timer_list msc_pong_timeout;
+
 extern int bsc_bootstrap_network(int (*layer4)(struct gsm_network *, int, void *), const char *cfg_file);
 extern int bsc_shutdown_net(struct gsm_network *net);
 
-
 struct llist_head *bsc_sccp_connections()
 {
 	return &active_connections;
 }
 
+/*
+ * Having a subscriber in the lchan is used to indicate that a SACH DEACTIVATE
+ * should be send. We will just introduce a fake subscriber and bind it to the
+ * lchan.
+ */
+static void assign_dummy_subscr(struct gsm_lchan *lchan)
+{
+	if (!lchan->conn.subscr) {
+		lchan->conn.subscr = subscr_get_or_create(bsc_gsmnet, "2323");
+		lchan->conn.subscr->lac = 2323;
+	}
+}
+
 struct bss_sccp_connection_data *bss_sccp_create_data()
 {
 	struct bss_sccp_connection_data *data;
@@ -95,6 +113,7 @@ struct bss_sccp_connection_data *bss_sccp_create_data()
 void bss_sccp_free_data(struct bss_sccp_connection_data *data)
 {
 	bsc_del_timer(&data->T10);
+	bsc_del_timer(&data->sccp_cc_timeout);
 	bsc_del_timer(&data->sccp_it);
 	if (data->sccp)
 		bsc_free_queued(data->sccp);
@@ -112,6 +131,47 @@ static void sccp_it_fired(void *_data)
 	bsc_schedule_timer(&data->sccp_it, SCCP_IT_TIMER, 0);
 }
 
+/* make sure to stop the T10 timer... bss_sccp_free_data is doing that */
+static void bss_close_lchans(struct bss_sccp_connection_data *bss)
+{
+	if (bss->lchan) {
+		bss->lchan->msc_data = NULL;
+		put_subscr_con(&bss->lchan->conn, 0);
+		bss->lchan = NULL;
+	}
+
+	if (bss->secondary_lchan) {
+		bss->secondary_lchan->msc_data = NULL;
+		put_subscr_con(&bss->secondary_lchan->conn, 0);
+		bss->secondary_lchan = NULL;
+	}
+}
+
+static void bss_force_close(struct bss_sccp_connection_data *bss)
+{
+	bss_close_lchans(bss);
+
+	/* force the close by poking stuff */
+	if (bss->sccp) {
+		sccp_connection_force_free(bss->sccp);
+		bss->sccp = NULL;
+	}
+
+	bss_sccp_free_data(bss);
+}
+
+/* check if this connection was ever confirmed and then recycle */
+static void sccp_check_cc(void *_data)
+{
+	struct bss_sccp_connection_data *data = _data;
+
+	if (data->sccp->connection_state >= SCCP_CONNECTION_STATE_ESTABLISHED)
+		return;
+
+	LOGP(DMSC, LOGL_ERROR, "The connection was never established\n");
+	bss_force_close(data);
+}
+
 
 /* GSM subscriber drop-ins */
 extern struct llist_head *subscr_bsc_active_subscriber(void);
@@ -181,27 +241,29 @@ void msc_outgoing_sccp_data(struct sccp_connection *conn, struct msgb *msg, unsi
 
 void msc_outgoing_sccp_state(struct sccp_connection *conn, int old_state)
 {
+	struct bss_sccp_connection_data *con_data;
+
 	if (conn->connection_state >= SCCP_CONNECTION_STATE_RELEASE_COMPLETE) {
+		con_data = (struct bss_sccp_connection_data *) conn->data_ctx;
+
 		LOGP(DMSC, LOGL_DEBUG, "Freeing sccp conn: %p state: %d\n", conn, conn->connection_state);
-		if (sccp_get_lchan(conn->data_ctx) != NULL) {
-			struct gsm_lchan *lchan = sccp_get_lchan(conn->data_ctx);
-
+		if (con_data->lchan || con_data->secondary_lchan) {
 			LOGP(DMSC, LOGL_ERROR, "ERROR: The lchan is still associated\n.");
-
-			lchan->msc_data = NULL;
-			put_subscr_con(&lchan->conn, 0);
+			bss_close_lchans(con_data);
 		}
 
-		bss_sccp_free_data((struct bss_sccp_connection_data *)conn->data_ctx);
+		bss_sccp_free_data(con_data);
 		sccp_connection_free(conn);
 		return;
 	} else if (conn->connection_state == SCCP_CONNECTION_STATE_ESTABLISHED) {
-		struct bss_sccp_connection_data *con_data;
-
 		LOGP(DMSC, LOGL_DEBUG, "Connection established: %p\n", conn);
 
-		/* start the inactivity test timer */
 		con_data = (struct bss_sccp_connection_data *) conn->data_ctx;
+
+		/* stop the CC timeout */
+		bsc_del_timer(&con_data->sccp_cc_timeout);
+
+		/* start the inactivity test timer */
 		con_data->sccp_it.cb = sccp_it_fired;
 		con_data->sccp_it.data = con_data;
 		bsc_schedule_timer(&con_data->sccp_it, SCCP_IT_TIMER, 0);
@@ -225,10 +287,8 @@ static int open_sccp_connection(struct msgb *layer3)
 	struct msgb *data;
 
 	/* When not connected to a MSC. We will simply close things down. */
-	if (!msc_con->is_authenticated) {
+	if (!bsc_gsmnet->msc_con->is_authenticated) {
 		LOGP(DMSC, LOGL_ERROR, "Not connected to a MSC. Not forwarding data.\n");
-		use_subscr_con(&layer3->lchan->conn);
-		put_subscr_con(&layer3->lchan->conn, 0);
 		return -1;
 	}
 
@@ -263,7 +323,14 @@ static int open_sccp_connection(struct msgb *layer3)
 	sccp_connection->data_ctx = con_data;
 	layer3->lchan->msc_data = con_data;
 
+	/* Make sure we open the connection */
+	con_data->sccp_cc_timeout.data = con_data;
+	con_data->sccp_cc_timeout.cb = sccp_check_cc;
+	bsc_schedule_timer(&con_data->sccp_cc_timeout, 10, 0);
+
 	/* FIXME: Use transaction for this */
+	/* assign a dummy subscriber */
+	assign_dummy_subscr(layer3->lchan);
 	use_subscr_con(&layer3->lchan->conn);
 	sccp_connection_connect(sccp_connection, &sccp_ssn_bssap, data);
 	msgb_free(data);
@@ -295,7 +362,14 @@ static int handle_paging_response(struct msgb *msg)
 	char mi_string[GSM48_MI_SIZE];
 	u_int8_t mi_type;
 
-	gsm48_paging_extract_mi(msg, mi_string, &mi_type);
+	struct gsm48_hdr *hdr;
+	struct gsm48_pag_resp *resp;
+
+	hdr = msgb_l3(msg);
+	resp = (struct gsm48_pag_resp *) &hdr->data[0];
+
+	gsm48_paging_extract_mi(resp, msgb_l3len(msg) - sizeof(*hdr),
+				mi_string, &mi_type);
 	LOGP(DMSC, LOGL_DEBUG, "PAGING RESPONSE: mi_type=0x%02x MI(%s)\n",
 		mi_type, mi_string);
 
@@ -365,17 +439,22 @@ static int handle_ass_compl(struct msgb *msg)
 		return -1;
 	}
 
+	/* assign a dummy subscriber */
+	assign_dummy_subscr(msg->lchan);
+
 	/* swap the channels and release the old */
 	old_chan = msg->lchan->msc_data->lchan;
-	msg->lchan->msc_data->lchan = msg->lchan;
-	msg->lchan->msc_data->secondary_lchan = NULL;
-	old_chan->msc_data = NULL;
+	if (old_chan) {
+		msg->lchan->msc_data->lchan = msg->lchan;
+		msg->lchan->msc_data->secondary_lchan = NULL;
+		old_chan->msc_data = NULL;
 
-	/* give up the old channel to not do a SACCH deactivate */
-	if (old_chan->conn.subscr)
-		subscr_put(old_chan->conn.subscr);
-	old_chan->conn.subscr = NULL;
-	put_subscr_con(&old_chan->conn, 1);
+		/* give up the old channel to not do a SACCH deactivate */
+		if (old_chan->conn.subscr)
+			subscr_put(old_chan->conn.subscr);
+		old_chan->conn.subscr = NULL;
+		put_subscr_con(&old_chan->conn, 1);
+	}
 
 	/* activate audio on it... */
 	if (is_ipaccess_bts(msg->lchan->ts->trx->bts) && msg->lchan->tch_mode != GSM48_CMODE_SIGN)
@@ -530,6 +609,12 @@ int gsm0408_rcvmsg(struct msgb *msg, u_int8_t link_id)
 		}
 
 		bsc_queue_connection_write(lchan_get_sccp(msg->lchan), dtap);
+	} else if (rc <= 0 && !msg->lchan->msc_data && msg->lchan->conn.use_count == 0) {
+		if (msg->lchan->state == LCHAN_S_ACTIVE) {
+			LOGP(DMSC, LOGL_NOTICE, "Closing unowned channel.\n");
+			use_subscr_con(&msg->lchan->conn);
+			put_subscr_con(&msg->lchan->conn, 0);
+		}
 	}
 
 	return rc;
@@ -586,7 +671,7 @@ static void print_usage()
 static int msc_queue_write(struct msgb *msg, int proto)
 {
 	ipaccess_prepend_header(msg, proto);
-	if (write_queue_enqueue(&msc_con->write_queue, msg) != 0) {
+	if (write_queue_enqueue(&bsc_gsmnet->msc_con->write_queue, msg) != 0) {
 		LOGP(DMSC, LOGL_FATAL, "Failed to queue IPA/%d\n", proto);
 		msgb_free(msg);
 		return -1;
@@ -602,7 +687,7 @@ static int msc_sccp_do_write(struct bsc_fd *fd, struct msgb *msg)
 	LOGP(DMSC, LOGL_DEBUG, "Sending SCCP to MSC: %u\n", msgb_l2len(msg));
 	LOGP(DMI, LOGL_DEBUG, "MSC TX %s\n", hexdump(msg->l2h, msgb_l2len(msg)));
 
-	ret = write(msc_con->write_queue.bfd.fd, msg->data, msg->len);
+	ret = write(bsc_gsmnet->msc_con->write_queue.bfd.fd, msg->data, msg->len);
 	if (ret < msg->len)
 		perror("MSC: Failed to send SCCP");
 
@@ -774,9 +859,9 @@ static void initialize_if_needed(void)
 	struct msgb *msg;
 
 
-	if (!msc_con->is_authenticated) {
+	if (!bsc_gsmnet->msc_con->is_authenticated) {
 		/* send a gsm 08.08 reset message from here */
-		msg = bssmap_create_reset();
+		msg = gsm0808_create_reset();
 		if (!msg) {
 			LOGP(DMSC, LOGL_ERROR, "Failed to create the reset message.\n");
 			return;
@@ -784,7 +869,7 @@ static void initialize_if_needed(void)
 
 		sccp_write(msg, &sccp_ssn_bssap, &sccp_ssn_bssap, 0);
 		msgb_free(msg);
-		msc_con->is_authenticated = 1;
+		bsc_gsmnet->msc_con->is_authenticated = 1;
 	}
 }
 
@@ -796,19 +881,38 @@ static void send_id_get_response(int fd)
 		return;
 	}
 
-	if (!bsc_gsmnet->bsc_token) {
-		LOGP(DMSC, LOGL_ERROR, "The bsc token is not set.\n");
+	msg = bsc_msc_id_get_resp(bsc_gsmnet->bsc_token);
+	if (!msg)
 		return;
-	}
-
-	msg = msgb_alloc_headroom(4096, 128, "id resp");
-
-	msg->l2h = msgb_v_put(msg, IPAC_MSGT_ID_RESP);
-	msgb_l16tv_put(msg, strlen(bsc_gsmnet->bsc_token) + 1,
-			IPAC_IDTAG_UNITNAME, (u_int8_t *) bsc_gsmnet->bsc_token);
 	msc_queue_write(msg, IPAC_PROTO_IPACCESS);
 }
 
+/*
+ * Send some packets to test the MSC.
+ */
+static void test_msc()
+{
+	struct msgb *msg;
+
+	if (!testmode)
+		return;
+
+	static const uint8_t pag_resp[] = {
+		0x01, 0xf3, 0x26, 0x09, 0x02, 0x02, 0x04, 0x02, 0x42,
+		0xfe, 0x0f, 0x1f, 0x00, 0x1d, 0x57, 0x05, 0x08, 0x00,
+		0x72, 0xf4, 0x80, 0x10, 0x1c, 0x9c, 0x40, 0x17, 0x10,
+		0x06, 0x27, 0x02, 0x03, 0x30, 0x18, 0xa0, 0x08, 0x59,
+		0x51, 0x30, 0x10, 0x30, 0x32, 0x80, 0x06, 0x00
+	};
+
+	msg = msgb_alloc_headroom(4096, 128, "paging response");
+	if (!msg)
+		return;
+	msg->l2h = msgb_put(msg, sizeof(pag_resp));
+	memcpy(msg->l2h, pag_resp, sizeof(pag_resp));
+	msc_queue_write(msg, IPAC_PROTO_SCCP);
+}
+
 /*
  * The connection to the MSC was lost and we will need to free all
  * resources and then attempt to reconnect.
@@ -820,31 +924,63 @@ static void msc_connection_was_lost(struct bsc_msc_connection *msc)
 	LOGP(DMSC, LOGL_ERROR, "Lost MSC connection. Freing stuff.\n");
 
 	llist_for_each_entry_safe(bss, tmp, &active_connections, active_connections) {
-		if (bss->lchan) {
-			bss->lchan->msc_data = NULL;
-			put_subscr_con(&bss->lchan->conn, 0);
-			bss->lchan = NULL;
-		}
-
-		if (bss->secondary_lchan) {
-			bss->secondary_lchan->msc_data = NULL;
-			put_subscr_con(&bss->secondary_lchan->conn, 0);
-			bss->secondary_lchan = NULL;
-		}
-
-		/* force the close by poking stuff */
-		if (bss->sccp) {
-			sccp_connection_force_free(bss->sccp);
-			bss->sccp = NULL;
-		}
-
-		bss_sccp_free_data(bss);
+		bss_force_close(bss);
 	}
 
+	bsc_del_timer(&msc_ping_timeout);
+	bsc_del_timer(&msc_pong_timeout);
+
 	msc->is_authenticated = 0;
 	bsc_msc_schedule_connect(msc);
 }
 
+static void msc_pong_timeout_cb(void *data)
+{
+	LOGP(DMSC, LOGL_ERROR, "MSC didn't answer PING. Closing connection.\n");
+	bsc_msc_lost(bsc_gsmnet->msc_con);
+}
+
+static void send_ping(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_alloc_headroom(4096, 128, "ping");
+	if (!msg) {
+		LOGP(DMSC, LOGL_ERROR, "Failed to create PING.\n");
+		return;
+	}
+
+	msg->l2h = msgb_put(msg, 1);
+	msg->l2h[0] = IPAC_MSGT_PING;
+
+	msc_queue_write(msg, IPAC_PROTO_IPACCESS);
+}
+
+static void msc_ping_timeout_cb(void *data)
+{
+	if (bsc_gsmnet->ping_timeout < 0)
+		return;
+
+	send_ping();
+
+	/* send another ping in 20 seconds */
+	bsc_schedule_timer(&msc_ping_timeout, bsc_gsmnet->ping_timeout, 0);
+
+	/* also start a pong timer */
+	bsc_schedule_timer(&msc_pong_timeout, bsc_gsmnet->pong_timeout, 0);
+}
+
+static void msc_connection_connected(struct bsc_msc_connection *con)
+{
+	int ret, on;
+	on = 1;
+	ret = setsockopt(con->write_queue.bfd.fd, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on));
+	if (ret != 0)
+                LOGP(DMSC, LOGL_ERROR, "Failed to set TCP_NODELAY: %s\n", strerror(errno));
+
+	msc_ping_timeout_cb(con);
+}
+
 /*
  * callback with IP access data
  */
@@ -857,7 +993,7 @@ static int ipaccess_a_fd_cb(struct bsc_fd *bfd)
 	if (!msg) {
 		if (error == 0) {
 			LOGP(DMSC, LOGL_ERROR, "The connection to the MSC was lost.\n");
-			bsc_msc_lost(msc_con);
+			bsc_msc_lost(bsc_gsmnet->msc_con);
 			return -1;
 		}
 
@@ -877,6 +1013,9 @@ static int ipaccess_a_fd_cb(struct bsc_fd *bfd)
 			initialize_if_needed();
 		else if (msg->l2h[0] == IPAC_MSGT_ID_GET) {
 			send_id_get_response(bfd->fd);
+			test_msc();
+		} else if (msg->l2h[0] == IPAC_MSGT_PONG) {
+			bsc_del_timer(&msc_pong_timeout);
 		}
 	} else if (hh->proto == IPAC_PROTO_SCCP) {
 		sccp_system_incoming(msg);
@@ -900,6 +1039,7 @@ static void print_help()
 	printf("  -l --local=IP. The local address of the MGCP.\n");
 	printf("  -e --log-level number. Set a global loglevel.\n");
 	printf("  -r --rf-ctl NAME. A unix domain socket to listen for cmds.\n");
+	printf("  -t --testmode. A special mode to provoke failures at the MSC.\n");
 }
 
 static void handle_options(int argc, char** argv)
@@ -916,10 +1056,11 @@ static void handle_options(int argc, char** argv)
 			{"local", 1, 0, 'l'},
 			{"log-level", 1, 0, 'e'},
 			{"rf-ctl", 1, 0, 'r'},
+			{"testmode", 0, 0, 't'},
 			{0, 0, 0, 0}
 		};
 
-		c = getopt_long(argc, argv, "hd:sTc:m:l:e:r:",
+		c = getopt_long(argc, argv, "hd:sTc:m:l:e:r:t",
 				long_options, &option_index);
 		if (c == -1)
 			break;
@@ -956,6 +1097,9 @@ static void handle_options(int argc, char** argv)
 		case 'r':
 			rf_ctl = optarg;
 			break;
+		case 't':
+			testmode = 1;
+			break;
 		default:
 			/* ignore */
 			break;
@@ -982,9 +1126,9 @@ static void signal_handler(int signal)
 		talloc_report_full(tall_bsc_ctx, stderr);
 		break;
 	case SIGUSR2:
-		if (!msc_con || !msc_con->is_connected)
+		if (!bsc_gsmnet->msc_con || !bsc_gsmnet->msc_con->is_connected)
 			return;
-		bsc_msc_lost(msc_con);
+		bsc_msc_lost(bsc_gsmnet->msc_con);
 		break;
 	default:
 		break;
@@ -1099,16 +1243,22 @@ int main(int argc, char **argv)
 	if (msc_address)
 		msc = msc_address;
 
-	msc_con = bsc_msc_create(msc, bsc_gsmnet->msc_port);
-	if (!msc_con) {
+	bsc_gsmnet->msc_con = bsc_msc_create(msc,
+					     bsc_gsmnet->msc_port,
+					     bsc_gsmnet->msc_prio);
+	if (!bsc_gsmnet->msc_con) {
 		fprintf(stderr, "Creating a bsc_msc_connection failed.\n");
 		exit(1);
 	}
 
-	msc_con->connection_loss = msc_connection_was_lost;
-	msc_con->write_queue.read_cb = ipaccess_a_fd_cb;
-	msc_con->write_queue.write_cb = msc_sccp_do_write;
-	bsc_msc_connect(msc_con);
+	msc_ping_timeout.cb = msc_ping_timeout_cb;
+	msc_pong_timeout.cb = msc_pong_timeout_cb;
+
+	bsc_gsmnet->msc_con->connection_loss = msc_connection_was_lost;
+	bsc_gsmnet->msc_con->connected = msc_connection_connected;
+	bsc_gsmnet->msc_con->write_queue.read_cb = ipaccess_a_fd_cb;
+	bsc_gsmnet->msc_con->write_queue.write_cb = msc_sccp_do_write;
+	bsc_msc_connect(bsc_gsmnet->msc_con);
 
 
 
@@ -1116,3 +1266,4 @@ int main(int argc, char **argv)
 		bsc_select_main(0);
 	}
 }
+

openbsc/src/bsc_msc_rf.c

@@ -59,14 +59,14 @@ static void handle_query(struct bsc_msc_rf_conn *conn)
 {
 	struct msgb *msg;
 	struct gsm_bts *bts;
-	char send = '0';
+	char send = RF_CMD_OFF;
 
 	llist_for_each_entry(bts, &conn->gsm_network->bts_list, list) {
 		struct gsm_bts_trx *trx;
 		llist_for_each_entry(trx, &bts->trx_list, list) {
 			if (trx->nm_state.availability == NM_AVSTATE_OK &&
 			    trx->nm_state.operational != NM_STATE_LOCKED) {
-					send = '1';
+					send = RF_CMD_ON;
 					break;
 			}
 		}

openbsc/src/bssap.c

@@ -40,6 +40,8 @@
 #define BSSMAP_MSG_SIZE 512
 #define BSSMAP_MSG_HEADROOM 128
 
+#define LINK_ID_CB 0
+
 static void bts_queue_send(struct msgb *msg, int link_id);
 static void bssmap_free_secondary(struct bss_sccp_connection_data *data);
 
@@ -172,7 +174,7 @@ static int bssmap_handle_clear_command(struct sccp_connection *conn,
 	}
 
 	/* send the clear complete message */
-	resp = bssmap_create_clear_complete();
+	resp = gsm0808_create_clear_complete();
 	if (!resp) {
 		LOGP(DMSC, LOGL_ERROR, "Sending clear complete failed.\n");
 		return -1;
@@ -310,7 +312,7 @@ static void bssmap_t10_fired(void *_conn)
 	msc_data = conn->data_ctx;
 	bssmap_free_secondary(msc_data);
 
-	resp = bssmap_create_assignment_failure(
+	resp = gsm0808_create_assignment_failure(
 		GSM0808_CAUSE_NO_RADIO_RESOURCE_AVAILABLE, NULL);
 	if (!resp) {
 		LOGP(DMSC, LOGL_ERROR, "Allocation failure: %p\n", conn);
@@ -763,36 +765,6 @@ struct msgb *bssmap_create_layer3(struct msgb *msg_l3)
 	return msg;
 }
 
-struct msgb *bssmap_create_reset(void)
-{
-	struct msgb *msg = msgb_alloc(30, "bssmap: reset");
-	if (!msg)
-		return NULL;
-
-	msg->l3h = msgb_put(msg, 6);
-	msg->l3h[0] = BSSAP_MSG_BSS_MANAGEMENT;
-	msg->l3h[1] = 0x04;
-	msg->l3h[2] = 0x30;
-	msg->l3h[3] = 0x04;
-	msg->l3h[4] = 0x01;
-	msg->l3h[5] = 0x20;
-	return msg;
-}
-
-struct msgb *bssmap_create_clear_complete(void)
-{
-	struct msgb *msg = msgb_alloc(30, "bssmap: clear complete");
-	if (!msg)
-		return NULL;
-
-	msg->l3h = msgb_put(msg, 3);
-	msg->l3h[0] = BSSAP_MSG_BSS_MANAGEMENT;
-	msg->l3h[1] = 1;
-	msg->l3h[2] = BSS_MAP_MSG_CLEAR_COMPLETE;
-
-	return msg;
-}
-
 struct msgb *bssmap_create_cipher_complete(struct msgb *layer3)
 {
 	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
@@ -900,7 +872,9 @@ static u_int8_t chan_mode_to_speech(struct gsm_lchan *lchan)
 		break;
 	}
 
-	if (lchan->type == GSM_LCHAN_TCH_H)
+	/* assume to always do AMR HR on any TCH type */
+	if (lchan->type == GSM_LCHAN_TCH_H ||
+	    lchan->tch_mode == GSM48_CMODE_SPEECH_AMR)
 		mode |= 0x4;
 
         return mode;
@@ -1003,36 +977,6 @@ struct msgb *bssmap_create_assignment_completed(struct gsm_lchan *lchan, u_int8_
 	return msg;
 }
 
-struct msgb *bssmap_create_assignment_failure(u_int8_t cause, u_int8_t *rr_cause)
-{
-	u_int8_t *data;
-	struct msgb *msg = msgb_alloc(35, "bssmap: ass fail");
-	if (!msg)
-		return NULL;
-
-	msg->l3h = msgb_put(msg, 6);
-	msg->l3h[0] = BSSAP_MSG_BSS_MANAGEMENT;
-	msg->l3h[1] = 0xff;
-	msg->l3h[2] = BSS_MAP_MSG_ASSIGMENT_FAILURE;
-	msg->l3h[3] = GSM0808_IE_CAUSE;
-	msg->l3h[4] = 1;
-	msg->l3h[5] = cause;
-
-	/* RR cause 3.2.2.22 */
-	if (rr_cause) {
-		data = msgb_put(msg, 2);
-		data[0] = GSM0808_IE_RR_CAUSE;
-		data[1] = *rr_cause;
-	}
-
-	/* Circuit pool 3.22.45 */
-	/* Circuit pool list 3.2.2.46 */
-
-	/* update the size */
-	msg->l3h[1] = msgb_l3len(msg) - 2;
-	return msg;
-}
-
 struct msgb *dtap_create_msg(struct msgb *msg_l3, u_int8_t link_id)
 {
 	struct dtap_header *header;
@@ -1236,7 +1180,7 @@ static void bts_queue_send(struct msgb *msg, int link_id)
 		if (msg->lchan->sapis[link_id & 0x7] != LCHAN_SAPI_UNUSED) {
 			rsl_data_request(msg, link_id);
 		} else {
-			msg->smsh = (unsigned char*) link_id;
+			msg->cb[LINK_ID_CB] = link_id;
 			msgb_enqueue(&data->gsm_queue, msg);
 			++data->gsm_queue_size;
 
@@ -1252,7 +1196,7 @@ static void bts_queue_send(struct msgb *msg, int link_id)
 		LOGP(DMSC, LOGL_DEBUG, "Queueing GSM0408 message on %p. Queue size: %d\n",
 		       data->sccp, data->gsm_queue_size + 1);
 
-		msg->smsh = (unsigned char*) link_id;
+		msg->cb[LINK_ID_CB] = link_id;
 		msgb_enqueue(&data->gsm_queue, msg);
 		++data->gsm_queue_size;
 	}
@@ -1278,7 +1222,7 @@ void bts_send_queued(struct bss_sccp_connection_data *data)
 	while (!llist_empty(&data->gsm_queue)) {
 		/* this is not allowed to fail */
 		msg = msgb_dequeue(&data->gsm_queue);
-		rsl_data_request(msg, (int) msg->smsh);
+		rsl_data_request(msg, msg->cb[LINK_ID_CB]);
 	}
 
 	data->gsm_queue_size = 0;
@@ -1300,7 +1244,7 @@ void bts_unblock_queue(struct bss_sccp_connection_data *data)
 	/* now queue them again to send RSL establish and such */
 	while (!llist_empty(&head)) {
 		msg = msgb_dequeue(&head);
-		bts_queue_send(msg, (int) msg->smsh);
+		bts_queue_send(msg, msg->cb[LINK_ID_CB]);
 	}
 }
 
@@ -1310,7 +1254,7 @@ void gsm0808_send_assignment_failure(struct gsm_lchan *lchan, u_int8_t cause, u_
 
 	bsc_del_timer(&lchan->msc_data->T10);
 	bssmap_free_secondary(lchan->msc_data);
-	resp = bssmap_create_assignment_failure(cause, rr_value);
+	resp = gsm0808_create_assignment_failure(cause, rr_value);
 	if (!resp) {
 		LOGP(DMSC, LOGL_ERROR, "Allocation failure: %p\n", lchan_get_sccp(lchan));
 		return;

openbsc/src/chan_alloc.c

@@ -25,6 +25,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
+#include <time.h>
 
 #include <openbsc/gsm_data.h>
 #include <openbsc/chan_alloc.h>
@@ -287,6 +288,9 @@ struct gsm_lchan *lchan_alloc(struct gsm_bts *bts, enum gsm_chan_t type,
 		memset(&lchan->conn, 0, sizeof(lchan->conn));
 		lchan->conn.lchan = lchan;
 		lchan->conn.bts = lchan->ts->trx->bts;
+
+		/* set the alloc time */
+		gettimeofday(&lchan->alloc_time, NULL);
 	} else {
 		struct challoc_signal_data sig;
 		sig.bts = bts;
@@ -381,6 +385,11 @@ static void _lchan_handle_release(struct gsm_lchan *lchan)
 		++lchan->conn.use_count;
 		gsm48_send_rr_release(lchan);
 		--lchan->conn.use_count;
+
+		/* avoid reentrancy */
+		subscr_put(lchan->conn.subscr);
+		lchan->conn.subscr = NULL;
+		return;
 	}
 
 	/* spoofed? message */

openbsc/src/e1_input.c

@@ -303,6 +303,10 @@ int e1inp_ts_config(struct e1inp_ts *ts, struct e1inp_line *line,
 
 	switch (type) {
 	case E1INP_TS_TYPE_SIGN:
+		if (line->driver)
+			ts->sign.delay = line->driver->default_delay;
+		else
+			ts->sign.delay = 100000;
 		INIT_LLIST_HEAD(&ts->sign.sign_links);
 		break;
 	case E1INP_TS_TYPE_TRAU:

openbsc/src/gsm_04_08.c

@@ -175,24 +175,24 @@ int gsm0408_loc_upd_rej(struct gsm_lchan *lchan, u_int8_t cause)
 {
 	struct gsm_subscriber_connection *conn;
 	struct gsm_bts *bts = lchan->ts->trx->bts;
-	struct msgb *msg = gsm48_msgb_alloc();
-	struct gsm48_hdr *gh;
+	struct msgb *msg;
+
+	counter_inc(bts->network->stats.loc_upd_resp.reject);
+
+	msg = gsm48_create_loc_upd_rej(cause);
+	if (!msg) {
+		LOGP(DMM, LOGL_ERROR, "Failed to create msg for LOCATION UPDATING REJECT.\n");
+		return -1;
+	}
 	
 	msg->lchan = lchan;
 	conn = &lchan->conn;
 
-	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1);
-	gh->proto_discr = GSM48_PDISC_MM;
-	gh->msg_type = GSM48_MT_MM_LOC_UPD_REJECT;
-	gh->data[0] = cause;
-
 	LOGP(DMM, LOGL_INFO, "Subscriber %s: LOCATION UPDATING REJECT "
 	     "LAC=%u BTS=%u\n", conn->subscr ?
 	     			subscr_name(conn->subscr) : "unknown",
 	     lchan->ts->trx->bts->location_area_code, lchan->ts->trx->bts->nr);
 
-	counter_inc(bts->network->stats.loc_upd_resp.reject);
-	
 	return gsm48_sendmsg(msg, NULL);
 }
 
@@ -574,19 +574,17 @@ static int gsm48_tx_mm_serv_ack(struct gsm_lchan *lchan)
 static int gsm48_tx_mm_serv_rej(struct gsm_subscriber_connection *conn,
 				enum gsm48_reject_value value)
 {
-	struct msgb *msg = gsm48_msgb_alloc();
-	struct gsm48_hdr *gh;
+	struct msgb *msg;
 
-	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1);
+	msg = gsm48_create_mm_serv_rej(value);
+	if (!msg) {
+		LOGP(DMM, LOGL_ERROR, "Failed to allocate CM Service Reject.\n");
+		return -1;
+	}
 
+	DEBUGP(DMM, "-> CM SERVICE Reject cause: %d\n", value);
 	msg->lchan = conn->lchan;
 	use_subscr_con(conn);
-
-	gh->proto_discr = GSM48_PDISC_MM;
-	gh->msg_type = GSM48_MT_MM_CM_SERV_REJ;
-	gh->data[0] = value;
-	DEBUGP(DMM, "-> CM SERVICE Reject cause: %d\n", value);
-
 	return gsm48_sendmsg(msg, NULL);
 }
 
@@ -609,7 +607,7 @@ static int gsm48_rx_mm_serv_req(struct msgb *msg)
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	struct gsm48_service_request *req =
 			(struct gsm48_service_request *)gh->data;
-	/* unfortunately in Phase1 the classmar2 length is variable */
+	/* unfortunately in Phase1 the classmark2 length is variable */
 	u_int8_t classmark2_len = gh->data[1];
 	u_int8_t *classmark2 = gh->data+2;
 	u_int8_t mi_len = *(classmark2 + classmark2_len);
@@ -779,13 +777,16 @@ static int gsm48_rx_rr_pag_resp(struct msgb *msg)
 {
 	struct gsm_bts *bts = msg->lchan->ts->trx->bts;
 	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_pag_resp *resp;
 	u_int8_t *classmark2_lv = gh->data + 1;
 	u_int8_t mi_type;
 	char mi_string[GSM48_MI_SIZE];
 	struct gsm_subscriber *subscr = NULL;
 	int rc = 0;
 
-	gsm48_paging_extract_mi(msg, mi_string, &mi_type);
+	resp = (struct gsm48_pag_resp *) &gh->data[0];
+	gsm48_paging_extract_mi(resp, msgb_l3len(msg) - sizeof(*gh),
+				mi_string, &mi_type);
 	DEBUGP(DRR, "PAGING RESPONSE: mi_type=0x%02x MI(%s)\n",
 		mi_type, mi_string);
 

openbsc/src/gsm_04_08_utils.c

@@ -285,16 +285,30 @@ int send_siemens_mrpci(struct gsm_lchan *lchan,
 	return rsl_siemens_mrpci(lchan, &mrpci);
 }
 
-int gsm48_paging_extract_mi(struct msgb *msg, char *mi_string, u_int8_t *mi_type)
+int gsm48_extract_mi(uint8_t *classmark2_lv, int length, char *mi_string, uint8_t *mi_type)
 {
-	struct gsm48_hdr *gh = msgb_l3(msg);
-	u_int8_t *classmark2_lv = gh->data + 1;
-	u_int8_t *mi_lv = gh->data + 2 + *classmark2_lv;
-	*mi_type = mi_lv[1] & GSM_MI_TYPE_MASK;
+	/* Check the size for the classmark */
+	if (length < 1 + *classmark2_lv)
+		return -1;
 
+	u_int8_t *mi_lv = classmark2_lv + *classmark2_lv + 1;
+	if (length < 2 + *classmark2_lv + mi_lv[0])
+		return -2;
+
+	*mi_type = mi_lv[1] & GSM_MI_TYPE_MASK;
 	return gsm48_mi_to_string(mi_string, GSM48_MI_SIZE, mi_lv+1, *mi_lv);
 }
 
+int gsm48_paging_extract_mi(struct gsm48_pag_resp *resp, int length,
+			    char *mi_string, u_int8_t *mi_type)
+{
+	static const uint32_t classmark_offset =
+		offsetof(struct gsm48_pag_resp, classmark2);
+	u_int8_t *classmark2_lv = (uint8_t *) &resp->classmark2;
+	return gsm48_extract_mi(classmark2_lv, length - classmark_offset,
+				mi_string, mi_type);
+}
+
 int gsm48_handle_paging_resp(struct msgb *msg, struct gsm_subscriber *subscr)
 {
 	struct gsm_bts *bts = msg->lchan->ts->trx->bts;
@@ -321,7 +335,7 @@ int gsm48_handle_paging_resp(struct msgb *msg, struct gsm_subscriber *subscr)
 	sig_data.bts	= msg->lchan->ts->trx->bts;
 	sig_data.lchan	= msg->lchan;
 
-	bts->network->stats.paging.completed++;
+	counter_inc(bts->network->stats.paging.completed);
 
 	dispatch_signal(SS_PAGING, S_PAGING_SUCCEEDED, &sig_data);
 
@@ -615,3 +629,36 @@ int gsm48_parse_meas_rep(struct gsm_meas_rep *rep, struct msgb *msg)
 
 	return 0;
 }
+
+struct msgb *gsm48_create_mm_serv_rej(enum gsm48_reject_value value)
+{
+	struct msgb *msg;
+	struct gsm48_hdr *gh;
+
+	msg = gsm48_msgb_alloc();
+	if (!msg)
+		return NULL;
+
+	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1);
+	gh->proto_discr = GSM48_PDISC_MM;
+	gh->msg_type = GSM48_MT_MM_CM_SERV_REJ;
+	gh->data[0] = value;
+
+	return msg;
+}
+
+struct msgb *gsm48_create_loc_upd_rej(uint8_t cause)
+{
+	struct gsm48_hdr *gh;
+	struct msgb *msg;
+
+	msg = gsm48_msgb_alloc();
+	if (!msg)
+		return NULL;
+
+	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1);
+	gh->proto_discr = GSM48_PDISC_MM;
+	gh->msg_type = GSM48_MT_MM_LOC_UPD_REJECT;
+	gh->data[0] = cause;
+	return msg;
+}

openbsc/src/gsm_04_11.c

@@ -675,7 +675,7 @@ static int gsm411_rx_rp_ud(struct msgb *msg, struct gsm_trans *trans,
 				     GSM411_RP_CAUSE_INV_MAND_INF);
 		return -EIO;
 	}
-	msg->smsh = tpdu;
+	msg->l4h = tpdu;
 
 	DEBUGP(DSMS, "DST(%u,%s)\n", dst_len, hexdump(dst, dst_len));
 

openbsc/src/gsm_04_80.c

@@ -257,7 +257,6 @@ int gsm0480_send_ussd_response(const struct msgb *in_msg, const char *response_t
 	if (((strlen(response_text) * 7) % 8) != 0)
 		response_len += 1;
 
-	msg->bts_link = in_msg->bts_link;
 	msg->lchan = in_msg->lchan;
 
 	/* First put the payload text into the message */
@@ -304,7 +303,6 @@ int gsm0480_send_ussd_reject(const struct msgb *in_msg,
 	struct msgb *msg = gsm48_msgb_alloc();
 	struct gsm48_hdr *gh;
 
-	msg->bts_link = in_msg->bts_link;
 	msg->lchan = in_msg->lchan;
 
 	/* First insert the problem code */

openbsc/src/gsm_data.c

@@ -172,6 +172,10 @@ struct gsm_bts_trx *gsm_bts_trx_alloc(struct gsm_bts *bts)
 	return trx;
 }
 
+static const uint8_t bts_nse_timer_default[] = { 3, 3, 3, 3, 3, 3, 10 };
+static const uint8_t bts_cell_timer_default[] =
+				{ 3, 3, 3, 3, 3, 10, 3, 10, 3, 10, 3 };
+
 struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
 			      u_int8_t tsc, u_int8_t bsic)
 {
@@ -213,6 +217,10 @@ struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
 		bts->gprs.nsvc[i].bts = bts;
 		bts->gprs.nsvc[i].id = i;
 	}
+	memcpy(&bts->gprs.nse.timer, bts_nse_timer_default,
+		sizeof(bts->gprs.nse.timer));
+	memcpy(&bts->gprs.cell.timer, bts_cell_timer_default,
+		sizeof(bts->gprs.cell.timer));
 
 	/* create our primary TRX */
 	bts->c0 = gsm_bts_trx_alloc(bts);
@@ -300,6 +308,8 @@ struct gsm_network *gsm_network_init(u_int16_t country_code, u_int16_t network_c
 
 	net->msc_ip = talloc_strdup(net, "127.0.0.1");
 	net->msc_port = 5000;
+	net->ping_timeout = 20;
+	net->pong_timeout = 5;
 
 	return net;
 }
@@ -454,33 +464,6 @@ const char *gsm_auth_policy_name(enum gsm_auth_policy policy)
 	return get_value_string(auth_policy_names, policy);
 }
 
-/* this should not be here but in gsm_04_08... but that creates
-   in turn a dependency nightmare (abis_nm depending on 04_08, ...) */
-static int gsm48_construct_ra(u_int8_t *buf, const struct gprs_ra_id *raid)
-{
-	u_int16_t mcc = raid->mcc;
-	u_int16_t mnc = raid->mnc;
-
-	buf[0] = ((mcc / 100) % 10) | (((mcc / 10) % 10) << 4);
-	buf[1] = (mcc % 10);
-
-	/* I wonder who came up with the stupidity of encoding the MNC
-	 * differently depending on how many digits its decimal number has! */
-	if (mnc < 100) {
-		buf[1] |= 0xf0;
-		buf[2] = ((mnc / 10) % 10) | ((mnc % 10) << 4);
-	} else {
-		buf[1] |= (mnc % 10) << 4;
-		buf[2] = ((mnc / 100) % 10) | (((mcc / 10) % 10) << 4);
-	}
-
-	*(u_int16_t *)(buf+3) = htons(raid->lac);
-
-	buf[5] = raid->rac;
-
-	return 6;
-}
-
 void gprs_ra_id_by_bts(struct gprs_ra_id *raid, struct gsm_bts *bts)
 {
 	raid->mcc = bts->network->country_code;

openbsc/src/input/ipaccess.c

@@ -265,6 +265,7 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg,
 			trx->rsl_link = e1inp_sign_link_create(e1i_ts,
 							E1INP_SIGN_RSL, trx,
 							trx->rsl_tei, 0);
+			trx->rsl_link->ts->sign.delay = 0;
 
 			/* get rid of our old temporary bfd */
 			memcpy(newbfd, bfd, sizeof(*newbfd));
@@ -572,8 +573,7 @@ static int handle_ts1_write(struct bsc_fd *bfd)
 	e1i_ts->sign.tx_timer.data = e1i_ts;
 
 	/* Reducing this might break the nanoBTS 900 init. */
-	/* BAND AID for paging problem */
-	bsc_schedule_timer(&e1i_ts->sign.tx_timer, 0, 100);
+	bsc_schedule_timer(&e1i_ts->sign.tx_timer, 0, e1i_ts->sign.delay);
 
 	return ret;
 }
@@ -607,6 +607,7 @@ static int ipaccess_fd_cb(struct bsc_fd *bfd, unsigned int what)
 struct e1inp_driver ipaccess_driver = {
 	.name = "ip.access",
 	.want_write = ts_want_write,
+	.default_delay = 100000,
 };
 
 /* callback of the OML listening filedescriptor */

openbsc/src/input/misdn.c

@@ -235,7 +235,7 @@ static int handle_ts1_write(struct bsc_fd *bfd)
 	/* set tx delay timer for next event */
 	e1i_ts->sign.tx_timer.cb = timeout_ts1_write;
 	e1i_ts->sign.tx_timer.data = e1i_ts;
-	bsc_schedule_timer(&e1i_ts->sign.tx_timer, 0, 50000);
+	bsc_schedule_timer(&e1i_ts->sign.tx_timer, 0, e1i_ts->sign.delay);
 
 	return ret;
 }
@@ -375,6 +375,7 @@ static int activate_bchan(struct e1inp_line *line, int ts, int act)
 struct e1inp_driver misdn_driver = {
 	.name = "mISDNuser",
 	.want_write = ts_want_write,
+	.default_delay = 50000,
 };
 
 static int mi_e1_setup(struct e1inp_line *line, int release_l2)

openbsc/src/ipaccess/ipaccess-config.c

@@ -1,8 +1,8 @@
 /* ip.access nanoBTS configuration tool */
 
 /* (C) 2009 by Harald Welte <laforge@gnumonks.org>
- * (C) 2009 by Holger Hans Peter Freyther
- * (C) 2009 by On Waves
+ * (C) 2009,2010 by Holger Hans Peter Freyther
+ * (C) 2009,2010 by On Waves
  * All Rights Reserved
  *
  * This program is free software; you can redistribute it and/or modify
@@ -59,6 +59,7 @@ static int sw_load_state = 0;
 static int oml_state = 0;
 static int dump_files = 0;
 static char *firmware_analysis = NULL;
+static int found_trx = 0;
 
 struct sw_load {
 	u_int8_t file_id[255];
@@ -91,23 +92,23 @@ static int ipacc_msg_nack(u_int8_t mt)
 	return 0;
 }
 
-static int ipacc_msg_ack(u_int8_t mt, struct gsm_bts *bts)
+static void check_restart_or_exit(struct gsm_bts_trx *trx)
+{
+	if (restart) {
+		abis_nm_ipaccess_restart(trx);
+	} else {
+		exit(0);
+	}
+}
+
+static int ipacc_msg_ack(u_int8_t mt, struct gsm_bts_trx *trx)
 {
 	if (sw_load_state == 1) {
 		fprintf(stderr, "The new software is activaed.\n");
-
-		if (restart) {
-			abis_nm_ipaccess_restart(bts);
-		} else {
-			exit(0);
-		}
+		check_restart_or_exit(trx);
 	} else if (oml_state == 1) {
 		fprintf(stderr, "Set the primary OML IP.\n");
-		if (restart) {
-			abis_nm_ipaccess_restart(bts);
-		} else {
-			exit(0);
-		}
+		check_restart_or_exit(trx);
 	}
 
 	return 0;
@@ -202,7 +203,7 @@ static int nm_sig_cb(unsigned int subsys, unsigned int signal,
 		return ipacc_msg_nack(ipacc_data->msg_type);
 	case S_NM_IPACC_ACK:
 		ipacc_data = signal_data;
-		return ipacc_msg_ack(ipacc_data->msg_type, ipacc_data->bts);
+		return ipacc_msg_ack(ipacc_data->msg_type, ipacc_data->trx);
 	case S_NM_TEST_REP:
 		return test_rep(signal_data);
 	case S_NM_IPACC_RESTART_ACK:
@@ -227,12 +228,12 @@ static int swload_cbfn(unsigned int hook, unsigned int event, struct msgb *_msg,
 		       void *data, void *param)
 {
 	struct msgb *msg;
-	struct gsm_bts *bts;
+	struct gsm_bts_trx *trx;
 
 	if (hook != GSM_HOOK_NM_SWLOAD)
 		return 0;
 
-	bts = (struct gsm_bts *) data;
+	trx = (struct gsm_bts_trx *) data;
 
 	switch (event) {
 	case NM_MT_LOAD_INIT_ACK:
@@ -271,7 +272,7 @@ static int swload_cbfn(unsigned int hook, unsigned int event, struct msgb *_msg,
 		msg->l2h[1] = msgb_l3len(msg) >> 8;
 		msg->l2h[2] = msgb_l3len(msg) & 0xff;
 		printf("Foo l2h: %p l3h: %p... length l2: %u  l3: %u\n", msg->l2h, msg->l3h, msgb_l2len(msg), msgb_l3len(msg));
-		abis_nm_ipaccess_set_nvattr(bts->c0, msg->l2h, msgb_l2len(msg));
+		abis_nm_ipaccess_set_nvattr(trx, msg->l2h, msgb_l2len(msg));
 		msgb_free(msg);
 		break;
 	case NM_MT_LOAD_END_NACK:
@@ -285,7 +286,7 @@ static int swload_cbfn(unsigned int hook, unsigned int event, struct msgb *_msg,
 	case NM_MT_ACTIVATE_SW_ACK:
 		break;
 	case NM_MT_LOAD_SEG_ACK:
-		percent = abis_nm_software_load_status(bts);
+		percent = abis_nm_software_load_status(trx->bts);
 		if (percent > percent_old)
 			printf("Software Download Progress: %d%%\n", percent);
 		percent_old = percent;
@@ -298,13 +299,13 @@ static int swload_cbfn(unsigned int hook, unsigned int event, struct msgb *_msg,
 	return 0;
 }
 
-static void bootstrap_om(struct gsm_bts *bts)
+static void bootstrap_om(struct gsm_bts_trx *trx)
 {
 	int len;
 	static u_int8_t buf[1024];
 	u_int8_t *cur = buf;
 
-	printf("OML link established\n");
+	printf("OML link established using TRX %d\n", trx->nr);
 
 	if (unit_id) {
 		len = strlen(unit_id);
@@ -316,7 +317,7 @@ static void bootstrap_om(struct gsm_bts *bts)
 		memcpy(buf+3, unit_id, len);
 		buf[3+len] = 0;
 		printf("setting Unit ID to '%s'\n", unit_id);
-		abis_nm_ipaccess_set_nvattr(bts->c0, buf, 3+len+1);
+		abis_nm_ipaccess_set_nvattr(trx, buf, 3+len+1);
 	}
 	if (prim_oml_ip) {
 		struct in_addr ia;
@@ -340,7 +341,7 @@ static void bootstrap_om(struct gsm_bts *bts)
 		*cur++ = 0;
 		printf("setting primary OML link IP to '%s'\n", inet_ntoa(ia));
 		oml_state = 1;
-		abis_nm_ipaccess_set_nvattr(bts->c0, buf, 3+len);
+		abis_nm_ipaccess_set_nvattr(trx, buf, 3+len);
 	}
 	if (nv_mask) {
 		len = 4;
@@ -354,12 +355,12 @@ static void bootstrap_om(struct gsm_bts *bts)
 		*cur++ = nv_mask >> 8;
 		printf("setting NV Flags/Mask to 0x%04x/0x%04x\n",
 			nv_flags, nv_mask);
-		abis_nm_ipaccess_set_nvattr(bts->c0, buf, 3+len);
+		abis_nm_ipaccess_set_nvattr(trx, buf, 3+len);
 	}
 
 	if (restart && !prim_oml_ip && !software) {
 		printf("restarting BTS\n");
-		abis_nm_ipaccess_restart(bts);
+		abis_nm_ipaccess_restart(trx);
 	}
 
 }
@@ -370,7 +371,6 @@ void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx)
 	case EVT_E1_TEI_UP:
 		switch (type) {
 		case E1INP_SIGN_OML:
-			bootstrap_om(trx->bts);
 			break;
 		case E1INP_SIGN_RSL:
 			/* FIXME */
@@ -389,22 +389,29 @@ void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx)
 }
 
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state)
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_inst)
 {
-	if (evt == EVT_STATECHG_OPER &&
+	if (obj_class == NM_OC_BASEB_TRANSC) {
+		if (!found_trx && obj_inst->trx_nr != 0xff) {
+			struct gsm_bts_trx *trx = container_of(obj, struct gsm_bts_trx, bb_transc);
+			bootstrap_om(trx);
+			found_trx = 1;
+		}
+	} else if (evt == EVT_STATECHG_OPER &&
 	    obj_class == NM_OC_RADIO_CARRIER &&
 	    new_state->availability == 3) {
 		struct gsm_bts_trx *trx = obj;
 
 		if (net_listen_testnr) {
 			u_int8_t phys_config[] = { 0x02, 0x0a, 0x00, 0x01, 0x02 };
-			abis_nm_perform_test(trx->bts, 2, 0, 0, 0xff,
+			abis_nm_perform_test(trx->bts, 2, 0, trx->nr, 0xff,
 					     net_listen_testnr, 1,
 					     phys_config, sizeof(phys_config));
 		} else if (software) {
 			int rc;
 			printf("Attempting software upload with '%s'\n", software);
-			rc = abis_nm_software_load(trx->bts, software, 19, 0, swload_cbfn, trx->bts);
+			rc = abis_nm_software_load(trx->bts, trx->nr, software, 19, 0, swload_cbfn, trx);
 			if (rc < 0) {
 				fprintf(stderr, "Failed to start software load\n");
 				exit(-3);
@@ -639,6 +646,7 @@ int main(int argc, char **argv)
 			{ "software", 1, 0, 'd' },
 			{ "firmware", 1, 0, 'f' },
 			{ "write-firmware", 0, 0, 'w' },
+			{ 0, 0, 0, 0 },
 		};
 
 		c = getopt_long(argc, argv, "u:o:rn:l:hs:d:f:w", long_options,
@@ -724,6 +732,8 @@ int main(int argc, char **argv)
 		exit(1);
 	}
 	
+	bts->oml_link->ts->sign.delay = 10;
+	bts->c0->rsl_link->ts->sign.delay = 10;
 	while (1) {
 		rc = bsc_select_main(0);
 		if (rc < 0)

openbsc/src/mgcp/mgcp_main.c

@@ -128,6 +128,15 @@ static int mgcp_rsip_cb(struct mgcp_config *cfg)
 	return 0;
 }
 
+static int mgcp_change_cb(struct mgcp_config *cfg, int endpoint, int state, int local_rtp)
+{
+	if (state != MGCP_ENDP_MDCX)
+		return 0;
+
+	mgcp_send_dummy(&cfg->endpoints[endpoint]);
+	return 0;
+}
+
 static int read_call_agent(struct bsc_fd *fd, unsigned int what)
 {
 	struct sockaddr_in addr;
@@ -200,6 +209,7 @@ int main(int argc, char** argv)
 
 	/* set some callbacks */
 	cfg->reset_cb = mgcp_rsip_cb;
+	cfg->change_cb = mgcp_change_cb;
 
         /* we need to bind a socket */
         if (rc == 0) {

openbsc/src/mgcp/mgcp_network.c

@@ -23,6 +23,7 @@
  */
 
 #include <string.h>
+#include <stdlib.h>
 #include <unistd.h>
 #include <endian.h>
 #include <errno.h>
@@ -31,7 +32,6 @@
 #include <arpa/inet.h>
 
 #include <osmocore/msgb.h>
-#include <osmocore/talloc.h>
 #include <osmocore/select.h>
 
 #include <openbsc/debug.h>
@@ -73,6 +73,8 @@ enum {
 	PROTO_RTCP,
 };
 
+#define DUMMY_LOAD 0x23
+
 
 static int udp_send(int fd, struct in_addr *addr, int port, char *buf, int len)
 {
@@ -84,6 +86,14 @@ static int udp_send(int fd, struct in_addr *addr, int port, char *buf, int len)
 	return sendto(fd, buf, len, 0, (struct sockaddr *)&out, sizeof(out));
 }
 
+int mgcp_send_dummy(struct mgcp_endpoint *endp)
+{
+	static char buf[] = { DUMMY_LOAD };
+
+	return udp_send(endp->local_rtp.fd, &endp->remote,
+			endp->net_rtp, buf, 1);
+}
+
 static void patch_payload(int payload, char *data, int len)
 {
 	struct rtp_hdr *rtp_hdr;
@@ -143,7 +153,7 @@ static int rtp_data_cb(struct bsc_fd *fd, unsigned int what)
 	 */
 	#warning "Slight spec violation. With connection mode recvonly we should attempt to forward."
 	dest = memcmp(&addr.sin_addr, &endp->remote, sizeof(addr.sin_addr)) == 0 &&
-                    (endp->net_rtp == addr.sin_port || endp->net_rtcp == addr.sin_port)
+		    (endp->net_rtp == addr.sin_port || endp->net_rtcp == addr.sin_port)
 			? DEST_BTS : DEST_NETWORK;
 	proto = fd == &endp->local_rtp ? PROTO_RTP : PROTO_RTCP;
 
@@ -163,26 +173,36 @@ static int rtp_data_cb(struct bsc_fd *fd, unsigned int what)
 			LOGP(DMGCP, LOGL_NOTICE, "Found BTS for endpoint: 0x%x on port: %d/%d of %s\n",
 				ENDPOINT_NUMBER(endp), ntohs(endp->bts_rtp), ntohs(endp->bts_rtcp),
 				inet_ntoa(addr.sin_addr));
+
 		}
 	}
 
+	/* throw away the dummy message */
+	if (rc == 1 && buf[0] == DUMMY_LOAD) {
+		LOGP(DMGCP, LOGL_NOTICE, "Filtered dummy on 0x%x\n",
+			ENDPOINT_NUMBER(endp));
+		return 0;
+	}
+
 	/* do this before the loop handling */
 	if (dest == DEST_NETWORK)
 		++endp->in_bts;
 	else
 		++endp->in_remote;
 
-	/* dispatch */
+	/* For loop toggle the destination and then dispatch. */
 	if (cfg->audio_loop)
 		dest = !dest;
 
 	if (dest == DEST_NETWORK) {
-		patch_payload(endp->net_payload_type, buf, rc);
+		if (proto == PROTO_RTP)
+			patch_payload(endp->net_payload_type, buf, rc);
 		return udp_send(fd->fd, &endp->remote,
 			     proto == PROTO_RTP ? endp->net_rtp : endp->net_rtcp,
 			     buf, rc);
 	} else {
-		patch_payload(endp->bts_payload_type, buf, rc);
+		if (proto == PROTO_RTP)
+			patch_payload(endp->bts_payload_type, buf, rc);
 		return udp_send(fd->fd, &endp->bts,
 			     proto == PROTO_RTP ? endp->bts_rtp : endp->bts_rtcp,
 			     buf, rc);
@@ -213,6 +233,14 @@ static int create_bind(const char *source_addr, struct bsc_fd *fd, int port)
 	return 0;
 }
 
+static int set_ip_tos(int fd, int tos)
+{
+	int ret;
+	ret = setsockopt(fd, IPPROTO_IP, IP_TOS,
+			 &tos, sizeof(tos));
+	return ret != 0;
+}
+
 static int bind_rtp(struct mgcp_endpoint *endp)
 {
 	struct mgcp_config *cfg = endp->cfg;
@@ -229,6 +257,9 @@ static int bind_rtp(struct mgcp_endpoint *endp)
 		goto cleanup1;
 	}
 
+	set_ip_tos(endp->local_rtp.fd, cfg->endp_tos);
+	set_ip_tos(endp->local_rtcp.fd, cfg->endp_tos);
+
 	endp->local_rtp.cb = rtp_data_cb;
 	endp->local_rtp.data = endp;
 	endp->local_rtp.when = BSC_FD_READ;

openbsc/src/mgcp/mgcp_protocol.c

@@ -135,7 +135,7 @@ static struct msgb *mgcp_msgb_alloc(void)
 	struct msgb *msg;
 	msg = msgb_alloc_headroom(4096, 128, "MGCP msg");
 	if (!msg)
-	    LOGP(DMGCP, LOGL_ERROR, "Failed to msgb for MGCP data.\n");
+		LOGP(DMGCP, LOGL_ERROR, "Failed to msgb for MGCP data.\n");
 
 	return msg;
 }
@@ -389,6 +389,7 @@ static struct msgb *handle_create_con(struct mgcp_config *cfg, struct msgb *msg)
 		if (cfg->force_realloc) {
 			LOGP(DMGCP, LOGL_NOTICE, "Endpoint 0x%x already allocated. Forcing realloc.\n",
 			    ENDPOINT_NUMBER(endp));
+			mgcp_free_endp(endp);
 		} else {
 			LOGP(DMGCP, LOGL_ERROR, "Endpoint is already used. 0x%x\n",
 			     ENDPOINT_NUMBER(endp));
@@ -485,6 +486,7 @@ static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 	const char *trans_id;
 	struct mgcp_endpoint *endp;
 	int error_code = 500;
+	int silent = 0;
 
 	found = mgcp_analyze_header(cfg, msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
 	if (found != 0)
@@ -517,6 +519,9 @@ static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 		    goto error3;
 		}
 		break;
+	case 'Z':
+		silent = strcmp("noanswer", (const char *)&msg->l3h[line_start + 3]) == 0;
+		break;
 	case '\0':
 		/* SDP file begins */
 		break;
@@ -562,6 +567,8 @@ static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 		case MGCP_POLICY_REJECT:
 			LOGP(DMGCP, LOGL_NOTICE, "MDCX rejected by policy on 0x%x\n",
 			     ENDPOINT_NUMBER(endp));
+			if (silent)
+				goto out_silent;
 			return create_response(500, "MDCX", trans_id);
 			break;
 		case MGCP_POLICY_DEFER:
@@ -579,6 +586,9 @@ static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 		ENDPOINT_NUMBER(endp), inet_ntoa(endp->remote), ntohs(endp->net_rtp));
 	if (cfg->change_cb)
 		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_MDCX, endp->rtp_port);
+	if (silent)
+		goto out_silent;
+
 	return create_response_with_sdp(endp, "MDCX", trans_id);
 
 error:
@@ -589,6 +599,10 @@ error:
 
 error3:
 	return create_response(error_code, "MDCX", trans_id);
+
+
+out_silent:
+	return NULL;
 }
 
 static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
@@ -598,6 +612,7 @@ static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 	const char *trans_id;
 	struct mgcp_endpoint *endp;
 	int error_code = 500;
+	int silent = 0;
 
 	found = mgcp_analyze_header(cfg, msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
 	if (found != 0)
@@ -619,6 +634,9 @@ static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 		if (verify_ci(endp, (const char *)&msg->l3h[line_start + 3]) != 0)
 			goto error3;
 		break;
+	case 'Z':
+		silent = strcmp("noanswer", (const char *)&msg->l3h[line_start + 3]) == 0;
+		break;
 	}
 	default:
 		LOGP(DMGCP, LOGL_NOTICE, "Unhandled option: '%c'/%d on 0x%x\n",
@@ -634,6 +652,8 @@ static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 		case MGCP_POLICY_REJECT:
 			LOGP(DMGCP, LOGL_NOTICE, "DLCX rejected by policy on 0x%x\n",
 			     ENDPOINT_NUMBER(endp));
+			if (silent)
+				goto out_silent;
 			return create_response(500, "DLCX", trans_id);
 			break;
 		case MGCP_POLICY_DEFER:
@@ -647,10 +667,14 @@ static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 	}
 
 	/* free the connection */
+	LOGP(DMGCP, LOGL_NOTICE, "Deleted endpoint on: 0x%x Server: %s:%u\n",
+		ENDPOINT_NUMBER(endp), inet_ntoa(endp->remote), ntohs(endp->net_rtp));
 	mgcp_free_endp(endp);
 	if (cfg->change_cb)
 		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_DLCX, endp->rtp_port);
 
+	if (silent)
+		goto out_silent;
 	return create_response(250, "DLCX", trans_id);
 
 error:
@@ -661,6 +685,9 @@ error:
 
 error3:
 	return create_response(error_code, "DLCX", trans_id);
+
+out_silent:
+	return NULL;
 }
 
 static struct msgb *handle_rsip(struct mgcp_config *cfg, struct msgb *msg)

openbsc/src/mgcp/mgcp_vty.c

@@ -57,6 +57,7 @@ static int config_write_mgcp(struct vty *vty)
 	vty_out(vty, "  bind port %u%s", g_cfg->source_port, VTY_NEWLINE);
 	vty_out(vty, "  bind early %u%s", !!g_cfg->early_bind, VTY_NEWLINE);
 	vty_out(vty, "  rtp base %u%s", g_cfg->rtp_base_port, VTY_NEWLINE);
+	vty_out(vty, "  rtp ip-tos %d%s", g_cfg->endp_tos, VTY_NEWLINE);
 	if (g_cfg->audio_payload != -1)
 		vty_out(vty, "  sdp audio payload number %d%s", g_cfg->audio_payload, VTY_NEWLINE);
 	if (g_cfg->audio_name)
@@ -103,7 +104,7 @@ DEFUN(cfg_mgcp,
 
 DEFUN(cfg_mgcp_local_ip,
       cfg_mgcp_local_ip_cmd,
-      "local ip IP",
+      "local ip A.B.C.D",
       "Set the IP to be used in SDP records")
 {
 	if (g_cfg->local_ip)
@@ -114,7 +115,7 @@ DEFUN(cfg_mgcp_local_ip,
 
 DEFUN(cfg_mgcp_bts_ip,
       cfg_mgcp_bts_ip_cmd,
-      "bts ip IP",
+      "bts ip A.B.C.D",
       "Set the IP of the BTS for RTP forwarding")
 {
 	if (g_cfg->bts_ip)
@@ -126,7 +127,7 @@ DEFUN(cfg_mgcp_bts_ip,
 
 DEFUN(cfg_mgcp_bind_ip,
       cfg_mgcp_bind_ip_cmd,
-      "bind ip IP",
+      "bind ip A.B.C.D",
       "Bind the MGCP to this local addr")
 {
 	if (g_cfg->source_addr)
@@ -141,11 +142,6 @@ DEFUN(cfg_mgcp_bind_port,
       "Bind the MGCP to this port")
 {
 	unsigned int port = atoi(argv[0]);
-	if (port > 65534) {
-		vty_out(vty, "%% wrong bind port '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	g_cfg->source_port = port;
 	return CMD_SUCCESS;
 }
@@ -156,11 +152,6 @@ DEFUN(cfg_mgcp_bind_early,
       "Bind all RTP ports early")
 {
 	unsigned int bind = atoi(argv[0]);
-	if (bind != 0 && bind != 1) {
-		vty_out(vty, "%% param must be 0 or 1.%s", VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	g_cfg->early_bind = bind == 1;
 	return CMD_SUCCESS;
 }
@@ -171,26 +162,26 @@ DEFUN(cfg_mgcp_rtp_base_port,
       "Base port to use")
 {
 	unsigned int port = atoi(argv[0]);
-	if (port > 65534) {
-		vty_out(vty, "%% wrong base port '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	g_cfg->rtp_base_port = port;
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_mgcp_rtp_ip_tos,
+      cfg_mgcp_rtp_ip_tos_cmd,
+      "rtp ip-tos <0-255>",
+      "Set the IP_TOS socket attribute on the RTP/RTCP sockets.\n" "The TOS value.")
+{
+	int tos = atoi(argv[0]);
+	g_cfg->endp_tos = tos;
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_mgcp_sdp_payload_number,
       cfg_mgcp_sdp_payload_number_cmd,
       "sdp audio payload number <1-255>",
       "Set the audio codec to use")
 {
 	unsigned int payload = atoi(argv[0]);
-	if (payload > 255) {
-		vty_out(vty, "%% wrong payload number '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	g_cfg->audio_payload = payload;
 	return CMD_SUCCESS;
 }
@@ -227,7 +218,7 @@ DEFUN(cfg_mgcp_number_endp,
 
 DEFUN(cfg_mgcp_forward_ip,
       cfg_mgcp_forward_ip_cmd,
-      "forward audio ip IP",
+      "forward audio ip A.B.C.D",
       "Forward packets from and to the IP. This disables most of the MGCP feature.")
 {
 	if (g_cfg->forward_ip)
@@ -269,6 +260,7 @@ int mgcp_vty_init(void)
 	install_element(MGCP_NODE, &cfg_mgcp_bind_port_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_bind_early_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_rtp_base_port_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_rtp_ip_tos_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_number_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_name_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_loop_cmd);
@@ -306,8 +298,8 @@ int mgcp_parse_config(const char *config_file, struct mgcp_config *cfg)
 
 	/*
 	 * This application supports two modes.
-         *    1.) a true MGCP gateway with support for AUEP, CRCX, MDCX, DLCX
-         *    2.) plain forwarding of RTP packets on the endpoints.
+	 *    1.) a true MGCP gateway with support for AUEP, CRCX, MDCX, DLCX
+	 *    2.) plain forwarding of RTP packets on the endpoints.
 	 * both modes are mutual exclusive
 	 */
 	if (g_cfg->forward_ip) {

openbsc/src/nat/bsc_mgcp_utils.c

@@ -26,6 +26,8 @@
 #include <openbsc/mgcp.h>
 #include <openbsc/mgcp_internal.h>
 
+#include <sccp/sccp.h>
+
 #include <osmocore/talloc.h>
 #include <osmocore/gsm0808.h>
 
@@ -37,10 +39,12 @@
 
 int bsc_mgcp_assign(struct sccp_connections *con, struct msgb *msg)
 {
+	struct sccp_connections *mcon;
 	struct tlv_parsed tp;
 	u_int16_t cic;
 	u_int8_t timeslot;
 	u_int8_t multiplex;
+	int combined;
 
 	if (!msg->l3h) {
 		LOGP(DNAT, LOGL_ERROR, "Assignment message should have l3h pointer.\n");
@@ -62,18 +66,27 @@ int bsc_mgcp_assign(struct sccp_connections *con, struct msgb *msg)
 	timeslot = cic & 0x1f;
 	multiplex = (cic & ~0x1f) >> 5;
 
-	con->msc_timeslot = (32 * multiplex) + timeslot;
+
+	combined = (32 * multiplex) + timeslot;
+
+	/* find stale connections using that endpoint */
+	llist_for_each_entry(mcon, &con->bsc->nat->sccp_connections, list_entry) {
+		if (mcon->msc_timeslot == combined) {
+			LOGP(DNAT, LOGL_ERROR,
+			     "Timeslot %d was assigned to 0x%x and now 0x%x\n",
+			     combined,
+			     sccp_src_ref_to_int(&mcon->patched_ref),
+			     sccp_src_ref_to_int(&con->patched_ref));
+			bsc_mgcp_dlcx(mcon);
+		}
+	}
+
+	con->msc_timeslot = combined;
 	con->bsc_timeslot = con->msc_timeslot;
 	return 0;
 }
 
-void bsc_mgcp_clear(struct sccp_connections *con)
-{
-	con->msc_timeslot = -1;
-	con->bsc_timeslot = -1;
-}
-
-void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int i)
+static void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int i)
 {
 	if (nat->bsc_endpoints[i].transaction_id) {
 		talloc_free(nat->bsc_endpoints[i].transaction_id);
@@ -81,17 +94,75 @@ void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int i)
 	}
 
 	nat->bsc_endpoints[i].bsc = NULL;
-	mgcp_free_endp(&nat->mgcp_cfg->endpoints[i]);
 }
 
 void bsc_mgcp_free_endpoints(struct bsc_nat *nat)
 {
 	int i;
 
-	for (i = 1; i < nat->mgcp_cfg->number_endpoints; ++i)
+	for (i = 1; i < nat->mgcp_cfg->number_endpoints; ++i){
 		bsc_mgcp_free_endpoint(nat, i);
+		mgcp_free_endp(&nat->mgcp_cfg->endpoints[i]);
+	}
 }
 
+/* send a MDCX where we do not want a response */
+static void bsc_mgcp_send_mdcx(struct bsc_connection *bsc, struct mgcp_endpoint *endp)
+{
+	char buf[2096];
+	int len;
+
+	len = snprintf(buf, sizeof(buf),
+		       "MDCX 23 %x@mgw MGCP 1.0\r\n"
+		       "Z: noanswer\r\n"
+		       "\r\n"
+		       "c=IN IP4 %s\r\n"
+		       "m=audio %d RTP/AVP 255\r\n",
+		       ENDPOINT_NUMBER(endp),
+		       bsc->nat->mgcp_cfg->source_addr,
+		       endp->rtp_port);
+	if (len < 0) {
+		LOGP(DMGCP, LOGL_ERROR, "snprintf for DLCX failed.\n");
+		return;
+	}
+}
+
+static void bsc_mgcp_send_dlcx(struct bsc_connection *bsc, int endpoint)
+{
+	char buf[2096];
+	int len;
+
+	len = snprintf(buf, sizeof(buf),
+		       "DLCX 23 %x@mgw MGCP 1.0\r\n"
+		       "Z: noanswer\r\n", endpoint);
+	if (len < 0) {
+		LOGP(DMGCP, LOGL_ERROR, "snprintf for DLCX failed.\n");
+		return;
+	}
+
+	bsc_write_mgcp(bsc, (u_int8_t *) buf, len);
+}
+
+void bsc_mgcp_init(struct sccp_connections *con)
+{
+	con->msc_timeslot = -1;
+	con->bsc_timeslot = -1;
+	con->crcx = 0;
+}
+
+void bsc_mgcp_dlcx(struct sccp_connections *con)
+{
+	/* send a DLCX down the stream */
+	if (con->bsc_timeslot != -1 && con->crcx) {
+		int endp = mgcp_timeslot_to_endpoint(0, con->msc_timeslot);
+		bsc_mgcp_send_dlcx(con->bsc, endp);
+		bsc_mgcp_free_endpoint(con->bsc->nat, endp);
+	}
+
+	bsc_mgcp_init(con);
+}
+
+
 struct sccp_connections *bsc_mgcp_find_con(struct bsc_nat *nat, int endpoint)
 {
 	struct sccp_connections *con = NULL;
@@ -125,10 +196,18 @@ int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const c
 	bsc_endp = &nat->bsc_endpoints[endpoint];
 	mgcp_endp = &nat->mgcp_cfg->endpoints[endpoint];
 
+	if (bsc_endp->transaction_id) {
+		LOGP(DMGCP, LOGL_ERROR, "Endpoint 0x%x had pending transaction: '%s'\n",
+		     endpoint, bsc_endp->transaction_id);
+		talloc_free(bsc_endp->transaction_id);
+		bsc_endp->transaction_id = NULL;
+	}
+	bsc_endp->bsc = NULL;
+
 	sccp = bsc_mgcp_find_con(nat, endpoint);
 
 	if (!sccp) {
-		LOGP(DMGCP, LOGL_ERROR, "Did not find BSC for a new connection on 0x%x for %d\n", endpoint, state);
+		LOGP(DMGCP, LOGL_ERROR, "Did not find BSC for change on endpoint: 0x%x state: %d\n", endpoint, state);
 
 		switch (state) {
 		case MGCP_ENDP_CRCX:
@@ -147,12 +226,6 @@ int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const c
 		}
 	}
 
-	if (bsc_endp->transaction_id) {
-		LOGP(DMGCP, LOGL_ERROR, "One transaction with id '%s' on 0x%x\n",
-		     bsc_endp->transaction_id, endpoint);
-		talloc_free(bsc_endp->transaction_id);
-	}
-
 	/* we need to generate a new and patched message */
 	bsc_msg = bsc_mgcp_rewrite((char *) nat->mgcp_msg, nat->mgcp_length,
 				   nat->mgcp_cfg->source_addr, mgcp_endp->rtp_port);
@@ -164,7 +237,6 @@ int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const c
 
 	bsc_endp->transaction_id = talloc_strdup(nat, transaction_id);
 	bsc_endp->bsc = sccp->bsc;
-	bsc_endp->pending_delete = 0;
 
 	/* we need to update some bits */
 	if (state == MGCP_ENDP_CRCX) {
@@ -176,15 +248,21 @@ int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const c
 		} else {
 			mgcp_endp->bts = sock.sin_addr;
 		}
-	} else if (state == MGCP_ENDP_DLCX) {
-		/* we will free the endpoint now in case the BSS does not respond */
-		bsc_mgcp_clear(sccp);
-		bsc_endp->pending_delete = 1;
-		mgcp_free_endp(mgcp_endp);
-	}
 
-	bsc_write(sccp->bsc, bsc_msg, NAT_IPAC_PROTO_MGCP);
-	return MGCP_POLICY_DEFER;
+		/* send the message and a fake MDCX for force sending of a dummy packet */
+		sccp->crcx = 1;
+		bsc_write(sccp->bsc, bsc_msg, NAT_IPAC_PROTO_MGCP);
+		bsc_mgcp_send_mdcx(sccp->bsc, mgcp_endp);
+		return MGCP_POLICY_DEFER;
+	} else if (state == MGCP_ENDP_DLCX) {
+		/* we will free the endpoint now and send a DLCX to the BSC */
+		msgb_free(bsc_msg);
+		bsc_mgcp_dlcx(sccp);
+		return MGCP_POLICY_CONT;
+	} else {
+		bsc_write(sccp->bsc, bsc_msg, NAT_IPAC_PROTO_MGCP);
+		return MGCP_POLICY_DEFER;
+	}
 }
 
 /*
@@ -234,13 +312,7 @@ void bsc_mgcp_forward(struct bsc_connection *bsc, struct msgb *msg)
 		return;
 	}
 
-	/* make it point to our endpoint if it was not deleted */
-	if (bsc_endp->pending_delete) {
-		bsc_endp->bsc = NULL;
-		bsc_endp->pending_delete = 0;
-	} else {
-		endp->ci = bsc_mgcp_extract_ci((const char *) msg->l2h);
-	}
+	endp->ci = bsc_mgcp_extract_ci((const char *) msg->l2h);
 
 	/* free some stuff */
 	talloc_free(bsc_endp->transaction_id);
@@ -401,7 +473,7 @@ static int mgcp_do_write(struct bsc_fd *bfd, struct msgb *msg)
 	return rc;
 }
 
-int bsc_mgcp_init(struct bsc_nat *nat)
+int bsc_mgcp_nat_init(struct bsc_nat *nat)
 {
 	int on;
 	struct sockaddr_in addr;
@@ -481,11 +553,7 @@ void bsc_mgcp_clear_endpoints_for(struct bsc_connection *bsc)
 		if (bsc_endp->bsc != bsc)
 			continue;
 
-		bsc_endp->bsc = NULL;
-		bsc_endp->pending_delete = 0;
-		if (bsc_endp->transaction_id)
-			talloc_free(bsc_endp->transaction_id);
-		bsc_endp->transaction_id = NULL;
+		bsc_mgcp_free_endpoint(bsc->nat, i);
 		mgcp_free_endp(&bsc->nat->mgcp_cfg->endpoints[i]);
 	}
 }

openbsc/src/nat/bsc_nat.c

@@ -23,6 +23,7 @@
  */
 #include <sys/socket.h>
 #include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <arpa/inet.h>
 
 #include <errno.h>
@@ -44,22 +45,25 @@
 #include <openbsc/telnet_interface.h>
 
 #include <osmocore/talloc.h>
+#include <osmocore/gsm0808.h>
 
 #include <vty/vty.h>
 
 #include <sccp/sccp.h>
 
+#define SCCP_CLOSE_TIME 20
+#define SCCP_CLOSE_TIME_TIMEOUT 19
+
 struct log_target *stderr_target;
 static const char *config_file = "bsc-nat.cfg";
 static struct in_addr local_addr;
-static struct bsc_msc_connection *msc_con;
 static struct bsc_fd bsc_listen;
 static const char *msc_ip = NULL;
+static struct timer_list sccp_close;
 
 
 static struct bsc_nat *nat;
 static void bsc_send_data(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length, int);
-static void remove_bsc_connection(struct bsc_connection *connection);
 static void msc_send_reset(struct bsc_msc_connection *con);
 
 struct bsc_config *bsc_config_num(struct bsc_nat *nat, int num)
@@ -77,7 +81,8 @@ struct bsc_config *bsc_config_num(struct bsc_nat *nat, int num)
  * below are stubs we need to link
  */
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state)
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_ins)
 {
 	return -1;
 }
@@ -90,6 +95,14 @@ int gsm0408_rcvmsg(struct msgb *msg, u_int8_t link_id)
 	return -1;
 }
 
+static void queue_for_msc(struct bsc_msc_connection *con, struct msgb *msg)
+{
+	if (write_queue_enqueue(&nat->msc_con->write_queue, msg) != 0) {
+		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
+		msgb_free(msg);
+	}
+}
+
 static void send_reset_ack(struct bsc_connection *bsc)
 {
 	static const u_int8_t gsm_reset_ack[] = {
@@ -101,6 +114,58 @@ static void send_reset_ack(struct bsc_connection *bsc)
 	bsc_send_data(bsc, gsm_reset_ack, sizeof(gsm_reset_ack), IPAC_PROTO_SCCP);
 }
 
+static void send_ping(struct bsc_connection *bsc)
+{
+	static const u_int8_t id_ping[] = {
+		IPAC_MSGT_PING,
+	};
+
+	bsc_send_data(bsc, id_ping, sizeof(id_ping), IPAC_PROTO_IPACCESS);
+}
+
+static void send_pong(struct bsc_connection *bsc)
+{
+	static const u_int8_t id_pong[] = {
+		IPAC_MSGT_PONG,
+	};
+
+	bsc_send_data(bsc, id_pong, sizeof(id_pong), IPAC_PROTO_IPACCESS);
+}
+
+static void bsc_pong_timeout(void *_bsc)
+{
+	struct bsc_connection *bsc = _bsc;
+
+	LOGP(DNAT, LOGL_ERROR, "BSC Nr: %d PONG timeout.\n", bsc->cfg->nr);
+	bsc_close_connection(bsc);
+}
+
+static void bsc_ping_timeout(void *_bsc)
+{
+	struct bsc_connection *bsc = _bsc;
+
+	if (bsc->nat->ping_timeout < 0)
+		return;
+
+	send_ping(bsc);
+
+	/* send another ping in 20 seconds */
+	bsc_schedule_timer(&bsc->ping_timeout, bsc->nat->ping_timeout, 0);
+
+	/* also start a pong timer */
+	bsc_schedule_timer(&bsc->pong_timeout, bsc->nat->pong_timeout, 0);
+}
+
+static void start_ping_pong(struct bsc_connection *bsc)
+{
+	bsc->pong_timeout.data = bsc;
+	bsc->pong_timeout.cb = bsc_pong_timeout;
+	bsc->ping_timeout.data = bsc;
+	bsc->ping_timeout.cb = bsc_ping_timeout;
+
+	bsc_ping_timeout(bsc);
+}
+
 static void send_id_ack(struct bsc_connection *bsc)
 {
 	static const u_int8_t id_ack[] = {
@@ -147,10 +212,7 @@ static void nat_send_rlsd(struct sccp_connections *conn)
 
 	ipaccess_prepend_header(msg, IPAC_PROTO_SCCP);
 
-	if (write_queue_enqueue(&msc_con->write_queue, msg) != 0) {
-		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
-		msgb_free(msg);
-	}
+	queue_for_msc(nat->msc_con, msg);
 }
 
 static void nat_send_rlc(struct sccp_source_reference *src,
@@ -173,10 +235,7 @@ static void nat_send_rlc(struct sccp_source_reference *src,
 
 	ipaccess_prepend_header(msg, IPAC_PROTO_SCCP);
 
-	if (write_queue_enqueue(&msc_con->write_queue, msg) != 0) {
-		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
-		msgb_free(msg);
-	}
+	queue_for_msc(nat->msc_con, msg);
 }
 
 static void send_mgcp_reset(struct bsc_connection *bsc)
@@ -199,7 +258,17 @@ static void initialize_msc_if_needed()
 		return;
 
 	nat->first_contact = 1;
-	msc_send_reset(msc_con);
+	msc_send_reset(nat->msc_con);
+}
+
+static void send_id_get_response()
+{
+	struct msgb *msg = bsc_msc_id_get_resp(nat->token);
+	if (!msg)
+		return;
+
+	ipaccess_prepend_header(msg, IPAC_PROTO_IPACCESS);
+	queue_for_msc(nat->msc_con, msg);
 }
 
 /*
@@ -226,6 +295,83 @@ static void bsc_send_data(struct bsc_connection *bsc, const u_int8_t *data, unsi
 	bsc_write(bsc, msg, proto);
 }
 
+static void bsc_send_con_refuse(struct bsc_connection *bsc,
+				struct bsc_nat_parsed *parsed, int con_type)
+{
+	struct msgb *payload;
+	struct msgb *refuse;
+
+	if (con_type == NAT_CON_TYPE_LU)
+		payload = gsm48_create_loc_upd_rej(GSM48_REJECT_PLMN_NOT_ALLOWED);
+	else if (con_type == NAT_CON_TYPE_CM_SERV_REQ)
+		payload = gsm48_create_mm_serv_rej(GSM48_REJECT_PLMN_NOT_ALLOWED);
+
+	/*
+	 * Some BSCs do not handle the payload inside a SCCP CREF msg
+	 * so we will need to:
+	 * 1.) Allocate a local connection and mark it as local..
+	 * 2.) queue data for downstream.. and the RLC should delete everything
+	 */
+	if (payload) {
+		struct msgb *cc, *udt, *rlsd;
+		struct sccp_connections *con;
+		con = create_sccp_src_ref(bsc, parsed);
+		if (!con)
+			goto send_refuse;
+
+		/* declare it local and assign a unique remote_ref */
+		con->con_type = NAT_CON_TYPE_LOCAL_REJECT;
+		con->con_local = 1;
+		con->has_remote_ref = 1;
+		con->remote_ref = con->patched_ref;
+
+		/* 1. create a confirmation */
+		cc = sccp_create_cc(&con->remote_ref, &con->real_ref);
+		if (!cc)
+			goto send_refuse;
+
+		/* 2. create the DT1 */
+		gsm0808_prepend_dtap_header(payload, 0);
+		udt = sccp_create_dt1(&con->real_ref, payload->data, payload->len);
+		if (!udt) {
+			msgb_free(cc);
+			goto send_refuse;
+		}
+
+		/* 3. send a RLSD */
+		rlsd = sccp_create_rlsd(&con->remote_ref, &con->real_ref,
+					SCCP_RELEASE_CAUSE_END_USER_ORIGINATED);
+		if (!rlsd) {
+			msgb_free(cc);
+			msgb_free(udt);
+			goto send_refuse;
+		}
+
+		bsc_write(bsc, cc, IPAC_PROTO_SCCP);
+		bsc_write(bsc, udt, IPAC_PROTO_SCCP);
+		bsc_write(bsc, rlsd, IPAC_PROTO_SCCP);
+		msgb_free(payload);
+		return;
+	}
+
+
+send_refuse:
+	if (payload)
+		msgb_free(payload);
+
+	refuse = sccp_create_refuse(parsed->src_local_ref,
+				    SCCP_REFUSAL_SCCP_FAILURE, NULL, 0);
+	if (!refuse) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "Creating refuse msg failed for SCCP 0x%x on BSC Nr: %d.\n",
+		      sccp_src_ref_to_int(parsed->src_local_ref), bsc->cfg->nr);
+		return;
+	}
+
+	bsc_write(bsc, refuse, IPAC_PROTO_SCCP);
+}
+
+
 static int forward_sccp_to_bts(struct msgb *msg)
 {
 	struct sccp_connections *con;
@@ -288,7 +434,7 @@ static int forward_sccp_to_bts(struct msgb *msg)
 			/* Exchange src/dest for the reply */
 			nat_send_rlc(parsed->dest_local_ref, parsed->src_local_ref);
 		} else if (!con)
-			LOGP(DNAT, LOGL_ERROR, "Unknown connection for msg type: 0x%x.\n", parsed->sccp_type);
+			LOGP(DNAT, LOGL_ERROR, "Unknown connection for msg type: 0x%x from the MSC.\n", parsed->sccp_type);
 	}
 
 	talloc_free(parsed);
@@ -311,7 +457,9 @@ send_to_all:
 	if (parsed->ipa_proto == IPAC_PROTO_SCCP && parsed->gsm_type == BSS_MAP_MSG_PAGING) {
 		int lac;
 		bsc = bsc_nat_find_bsc(nat, msg, &lac);
-		if (bsc)
+		if (bsc && bsc->cfg->forbid_paging)
+			LOGP(DNAT, LOGL_DEBUG, "Paging forbidden for BTS: %d\n", bsc->cfg->nr);
+		else if (bsc)
 			bsc_send_data(bsc, msg->l2h, msgb_l2len(msg), parsed->ipa_proto);
 		else
 			LOGP(DNAT, LOGL_ERROR, "Could not determine BSC for paging on lac: %d/0x%x\n",
@@ -340,7 +488,7 @@ static void msc_connection_was_lost(struct bsc_msc_connection *con)
 
 	LOGP(DMSC, LOGL_ERROR, "Closing all connections downstream.\n");
 	llist_for_each_entry_safe(bsc, tmp, &nat->bsc_connections, list_entry)
-		remove_bsc_connection(bsc);
+		bsc_close_connection(bsc);
 
 	nat->first_contact = 0;
 	bsc_mgcp_free_endpoints(nat);
@@ -367,10 +515,7 @@ static void msc_send_reset(struct bsc_msc_connection *msc_con)
 	msg->l2h = msgb_put(msg, sizeof(reset));
 	memcpy(msg->l2h, reset, msgb_l2len(msg));
 
-	if (write_queue_enqueue(&msc_con->write_queue, msg) != 0) {
-		LOGP(DMSC, LOGL_ERROR, "Failed to enqueue reset msg.\n");
-		msgb_free(msg);
-	}
+	queue_for_msc(nat->msc_con, msg);
 
 	LOGP(DMSC, LOGL_NOTICE, "Scheduled GSM0808 reset msg for the MSC.\n");
 }
@@ -382,13 +527,12 @@ static int ipaccess_msc_read_cb(struct bsc_fd *bfd)
 	struct ipaccess_head *hh;
 
 	if (!msg) {
-		if (error == 0) {
+		if (error == 0)
 			LOGP(DNAT, LOGL_FATAL, "The connection the MSC was lost, exiting\n");
-			bsc_msc_lost(msc_con);
-			return -1;
-		}
+		else
+			LOGP(DNAT, LOGL_ERROR, "Failed to parse ip access message: %d\n", error);
 
-		LOGP(DNAT, LOGL_ERROR, "Failed to parse ip access message: %d\n", error);
+		bsc_msc_lost(nat->msc_con);
 		return -1;
 	}
 
@@ -399,9 +543,12 @@ static int ipaccess_msc_read_cb(struct bsc_fd *bfd)
 	ipaccess_rcvmsg_base(msg, bfd);
 
 	/* initialize the networking. This includes sending a GSM08.08 message */
-	if (hh->proto == IPAC_PROTO_IPACCESS && msg->l2h[0] == IPAC_MSGT_ID_ACK)
-		initialize_msc_if_needed();
-	else if (hh->proto == IPAC_PROTO_SCCP)
+	if (hh->proto == IPAC_PROTO_IPACCESS) {
+		if (msg->l2h[0] == IPAC_MSGT_ID_ACK)
+			initialize_msc_if_needed();
+		else if (msg->l2h[0] == IPAC_MSGT_ID_GET)
+			send_id_get_response();
+	} else if (hh->proto == IPAC_PROTO_SCCP)
 		forward_sccp_to_bts(msg);
 
 	msgb_free(msg);
@@ -432,29 +579,33 @@ static int ipaccess_msc_write_cb(struct bsc_fd *bfd, struct msgb *msg)
  * remove it from the patching of SCCP header lists
  * as well. Maybe in the future even close connection..
  */
-static void remove_bsc_connection(struct bsc_connection *connection)
+void bsc_close_connection(struct bsc_connection *connection)
 {
 	struct sccp_connections *sccp_patch, *tmp;
-	bsc_unregister_fd(&connection->write_queue.bfd);
-	close(connection->write_queue.bfd.fd);
-	write_queue_clear(&connection->write_queue);
-	llist_del(&connection->list_entry);
 
 	/* stop the timeout timer */
 	bsc_del_timer(&connection->id_timeout);
+	bsc_del_timer(&connection->ping_timeout);
+	bsc_del_timer(&connection->pong_timeout);
 
 	/* remove all SCCP connections */
 	llist_for_each_entry_safe(sccp_patch, tmp, &nat->sccp_connections, list_entry) {
 		if (sccp_patch->bsc != connection)
 			continue;
 
-		nat_send_rlsd(sccp_patch);
+		if (sccp_patch->has_remote_ref)
+			nat_send_rlsd(sccp_patch);
 		sccp_connection_destroy(sccp_patch);
 	}
 
 	/* close endpoints allocated by this BSC */
 	bsc_mgcp_clear_endpoints_for(connection);
 
+	bsc_unregister_fd(&connection->write_queue.bfd);
+	close(connection->write_queue.bfd.fd);
+	write_queue_clear(&connection->write_queue);
+	llist_del(&connection->list_entry);
+
 	talloc_free(connection);
 }
 
@@ -468,7 +619,7 @@ static void ipaccess_close_bsc(void *data)
 	getpeername(conn->write_queue.bfd.fd, (struct sockaddr *) &sock, &len);
 	LOGP(DNAT, LOGL_ERROR, "BSC on %s didn't respond to identity request. Closing.\n",
 	     inet_ntoa(sock.sin_addr));
-	remove_bsc_connection(conn);
+	bsc_close_connection(conn);
 }
 
 static void ipaccess_auth_bsc(struct tlv_parsed *tvp, struct bsc_connection *bsc)
@@ -476,23 +627,35 @@ static void ipaccess_auth_bsc(struct tlv_parsed *tvp, struct bsc_connection *bsc
 	struct bsc_config *conf;
 	const char* token = (const char *) TLVP_VAL(tvp, IPAC_IDTAG_UNITNAME);
 
+	if (bsc->cfg) {
+		LOGP(DNAT, LOGL_ERROR, "Reauth on fd %d bsc nr %d\n",
+		     bsc->write_queue.bfd.fd, bsc->cfg->nr);
+		return;
+	}
+
 	llist_for_each_entry(conf, &bsc->nat->bsc_configs, entry) {
 		if (strcmp(conf->token, token) == 0) {
 			counter_inc(conf->stats.net.reconn);
 			bsc->authenticated = 1;
 			bsc->cfg = conf;
 			bsc_del_timer(&bsc->id_timeout);
-			LOGP(DNAT, LOGL_NOTICE, "Authenticated bsc nr: %d lac: %d\n", conf->nr, conf->lac);
+			LOGP(DNAT, LOGL_NOTICE, "Authenticated bsc nr: %d lac: %d on fd %d\n",
+			     conf->nr, conf->lac, bsc->write_queue.bfd.fd);
+			start_ping_pong(bsc);
 			return;
 		}
 	}
 
-	LOGP(DNAT, LOGL_ERROR, "No bsc found for token %s.\n", token);
+	LOGP(DNAT, LOGL_ERROR, "No bsc found for token %s on fd: %d.\n", token,
+	     bsc->write_queue.bfd.fd);
 }
 
 static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 {
-	struct sccp_connections *con;
+	int con_found = 0;
+	int con_filter = 0;
+	struct bsc_connection *con_bsc = NULL;
+	int con_type;
 	struct bsc_nat_parsed *parsed;
 
 	/* Parse and filter messages */
@@ -520,21 +683,37 @@ static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 
 	/* modify the SCCP entries */
 	if (parsed->ipa_proto == IPAC_PROTO_SCCP) {
+		struct sccp_connections *con;
 		switch (parsed->sccp_type) {
 		case SCCP_MSG_TYPE_CR:
-			if (create_sccp_src_ref(bsc, msg, parsed) != 0)
+			if (bsc_nat_filter_sccp_cr(bsc, msg, parsed, &con_type) != 0)
+				goto exit3;
+			if (!create_sccp_src_ref(bsc, parsed))
 				goto exit2;
-			con = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+			con = patch_sccp_src_ref_to_msc(msg, parsed, bsc);
+			con->con_type = con_type;
+			con_found = 1;
+			con_bsc = con->bsc;
 			break;
 		case SCCP_MSG_TYPE_RLSD:
 		case SCCP_MSG_TYPE_CREF:
 		case SCCP_MSG_TYPE_DT1:
 		case SCCP_MSG_TYPE_CC:
 		case SCCP_MSG_TYPE_IT:
-			con = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+			con = patch_sccp_src_ref_to_msc(msg, parsed, bsc);
+			if (con) {
+				con_found = 1;
+				con_bsc = con->bsc;
+				con_filter = con->con_local;
+			}
 			break;
 		case SCCP_MSG_TYPE_RLC:
-			con = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+			con = patch_sccp_src_ref_to_msc(msg, parsed, bsc);
+			if (con) {
+				con_found = 1;
+				con_bsc = con->bsc;
+				con_filter = con->con_local;
+			}
 			remove_sccp_src_ref(bsc, msg, parsed);
 			break;
 		case SCCP_MSG_TYPE_UDT:
@@ -555,16 +734,18 @@ static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 		goto exit2;
 	}
 
-	if (con && con->bsc != bsc) {
-		LOGP(DNAT, LOGL_ERROR, "Found the wrong entry.\n");
+	if (con_found && con_bsc != bsc) {
+		LOGP(DNAT, LOGL_ERROR, "The connection belongs to a different BTS: input: %d con: %d\n",
+		     bsc->cfg->nr, con_bsc->cfg->nr);
 		goto exit2;
 	}
 
+	/* do not forward messages to the MSC */
+	if (con_filter)
+		goto exit2;
+
 	/* send the non-filtered but maybe modified msg */
-	if (write_queue_enqueue(&msc_con->write_queue, msg) != 0) {
-		LOGP(DNAT, LOGL_ERROR, "Can not queue message for the MSC.\n");
-		msgb_free(msg);
-	}
+	queue_for_msc(nat->msc_con, msg);
 	talloc_free(parsed);
 	return 0;
 
@@ -591,6 +772,13 @@ exit2:
 	talloc_free(parsed);
 	msgb_free(msg);
 	return -1;
+
+exit3:
+	/* send a SCCP Connection Refused */
+	bsc_send_con_refuse(bsc, parsed, con_type);
+	talloc_free(parsed);
+	msgb_free(msg);
+	return -1;
 }
 
 static int ipaccess_bsc_read_cb(struct bsc_fd *bfd)
@@ -598,14 +786,19 @@ static int ipaccess_bsc_read_cb(struct bsc_fd *bfd)
 	int error;
 	struct bsc_connection *bsc = bfd->data;
 	struct msgb *msg = ipaccess_read_msg(bfd, &error);
+	struct ipaccess_head *hh;
 
 	if (!msg) {
-		if (error == 0) {
-			LOGP(DNAT, LOGL_ERROR,	"The connection to the BSC was lost. Cleaning it\n");
-			remove_bsc_connection(bsc);
-		} else {
-			LOGP(DNAT, LOGL_ERROR, "Failed to parse ip access message: %d\n", error);
-		}
+		if (error == 0)
+			LOGP(DNAT, LOGL_ERROR,
+			     "The connection to the BSC Nr: %d was lost. Cleaning it\n",
+			     bsc->cfg ? bsc->cfg->nr : -1);
+		else
+			LOGP(DNAT, LOGL_ERROR,
+			     "Stream error on BSC Nr: %d. Failed to parse ip access message: %d\n",
+			     bsc->cfg ? bsc->cfg->nr : -1, error);
+
+		bsc_close_connection(bsc);
 		return -1;
 	}
 
@@ -613,6 +806,21 @@ static int ipaccess_bsc_read_cb(struct bsc_fd *bfd)
 	LOGP(DNAT, LOGL_DEBUG, "MSG from BSC: %s proto: %d\n", hexdump(msg->data, msg->len), msg->l2h[0]);
 
 	/* Handle messages from the BSC */
+	hh = (struct ipaccess_head *) msg->data;
+
+	/* stop the pong timeout */
+	if (hh->proto == IPAC_PROTO_IPACCESS) {
+		if (msg->l2h[0] == IPAC_MSGT_PONG) {
+			bsc_del_timer(&bsc->pong_timeout);
+			msgb_free(msg);
+			return 0;
+		} else if (msg->l2h[0] == IPAC_MSGT_PING) {
+			send_pong(bsc);
+			msgb_free(msg);
+			return 0;
+		}
+	}
+
 	/* FIXME: Currently no PONG is sent to the BSC */
 	/* FIXME: Currently no ID ACK is sent to the BSC */
 	forward_sccp_to_msc(bsc, msg);
@@ -634,17 +842,17 @@ static int ipaccess_bsc_write_cb(struct bsc_fd *bfd, struct msgb *msg)
 static int ipaccess_listen_bsc_cb(struct bsc_fd *bfd, unsigned int what)
 {
 	struct bsc_connection *bsc;
-	int ret;
+	int fd, rc, on;
 	struct sockaddr_in sa;
 	socklen_t sa_len = sizeof(sa);
 
 	if (!(what & BSC_FD_READ))
 		return 0;
 
-	ret = accept(bfd->fd, (struct sockaddr *) &sa, &sa_len);
-	if (ret < 0) {
+	fd = accept(bfd->fd, (struct sockaddr *) &sa, &sa_len);
+	if (fd < 0) {
 		perror("accept");
-		return ret;
+		return fd;
 	}
 
 	/* count the reconnect */
@@ -653,12 +861,22 @@ static int ipaccess_listen_bsc_cb(struct bsc_fd *bfd, unsigned int what)
 	/*
 	 * if we are not connected to a msc... just close the socket
 	 */
-	if (!msc_con->is_connected) {
+	if (!nat->msc_con->is_connected) {
 		LOGP(DNAT, LOGL_NOTICE, "Disconnecting BSC due lack of MSC connection.\n");
-		close(ret);
+		close(fd);
 		return 0;
 	}
 
+	on = 1;
+	rc = setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on));
+	if (rc != 0)
+                LOGP(DNAT, LOGL_ERROR, "Failed to set TCP_NODELAY: %s\n", strerror(errno));
+
+	rc = setsockopt(fd, IPPROTO_IP, IP_TOS,
+			&nat->bsc_ip_tos, sizeof(nat->bsc_ip_tos));
+	if (rc != 0)
+		LOGP(DNAT, LOGL_ERROR, "Failed to set IP_TOS: %s\n", strerror(errno));
+
 	/* todo... do something with the connection */
 	/* todo... use GNUtls to see if we want to trust this as a BTS */
 
@@ -668,24 +886,24 @@ static int ipaccess_listen_bsc_cb(struct bsc_fd *bfd, unsigned int what)
 	bsc = bsc_connection_alloc(nat);
 	if (!bsc) {
 		LOGP(DNAT, LOGL_ERROR, "Failed to allocate BSC struct.\n");
-		close(ret);
+		close(fd);
 		return -1;
 	}
 
-	write_queue_init(&bsc->write_queue, 100);
 	bsc->write_queue.bfd.data = bsc;
-	bsc->write_queue.bfd.fd = ret;
+	bsc->write_queue.bfd.fd = fd;
 	bsc->write_queue.read_cb = ipaccess_bsc_read_cb;
 	bsc->write_queue.write_cb = ipaccess_bsc_write_cb;
 	bsc->write_queue.bfd.when = BSC_FD_READ;
 	if (bsc_register_fd(&bsc->write_queue.bfd) < 0) {
 		LOGP(DNAT, LOGL_ERROR, "Failed to register BSC fd.\n");
-		close(ret);
+		close(fd);
 		talloc_free(bsc);
 		return -2;
 	}
 
-	LOGP(DNAT, LOGL_NOTICE, "Registered new BSC\n");
+	LOGP(DNAT, LOGL_NOTICE, "BSC connection on %d with IP: %s\n",
+		fd, inet_ntoa(sa.sin_addr));
 	llist_add(&bsc->list_entry, &nat->bsc_connections);
 	send_id_ack(bsc);
 	send_id_req(bsc);
@@ -696,7 +914,7 @@ static int ipaccess_listen_bsc_cb(struct bsc_fd *bfd, unsigned int what)
 	 */
 	bsc->id_timeout.data = bsc;
 	bsc->id_timeout.cb = ipaccess_close_bsc;
-	bsc_schedule_timer(&bsc->id_timeout, 2, 0);
+	bsc_schedule_timer(&bsc->id_timeout, nat->auth_timeout, 0);
 	return 0;
 }
 
@@ -817,9 +1035,43 @@ static void signal_handler(int signal)
 	}
 }
 
+static void sccp_close_unconfirmed(void *_data)
+{
+	struct sccp_connections *conn, *tmp1;
+	struct timespec now;
+	clock_gettime(CLOCK_MONOTONIC, &now);
+
+	llist_for_each_entry_safe(conn, tmp1, &nat->sccp_connections, list_entry) {
+		if (conn->has_remote_ref)
+			continue;
+
+		int diff = (now.tv_sec - conn->creation_time.tv_sec) / 60;
+		if (diff < SCCP_CLOSE_TIME_TIMEOUT)
+			continue;
+
+		LOGP(DNAT, LOGL_ERROR, "SCCP connection 0x%x/0x%x was never confirmed.\n",
+		     sccp_src_ref_to_int(&conn->real_ref),
+		     sccp_src_ref_to_int(&conn->patched_ref));
+		sccp_connection_destroy(conn);
+	}
+
+	bsc_schedule_timer(&sccp_close, SCCP_CLOSE_TIME, 0);
+}
+
+extern void *tall_msgb_ctx;
+extern void *tall_ctr_ctx;
+static void talloc_init_ctx()
+{
+	tall_bsc_ctx = talloc_named_const(NULL, 0, "nat");
+	tall_msgb_ctx = talloc_named_const(tall_bsc_ctx, 0, "msgb");
+	tall_ctr_ctx = talloc_named_const(tall_bsc_ctx, 0, "counter");
+}
+
 int main(int argc, char** argv)
 {
+	talloc_init_ctx();
 	log_init(&log_info);
+
 	stderr_target = log_target_create_stderr();
 	log_add_target(stderr_target);
 	log_set_all_filter(stderr_target, 1);
@@ -858,20 +1110,20 @@ int main(int argc, char** argv)
 	/*
 	 * Setup the MGCP code..
 	 */
-	if (bsc_mgcp_init(nat) != 0)
+	if (bsc_mgcp_nat_init(nat) != 0)
 		return -4;
 
 	/* connect to the MSC */
-	msc_con = bsc_msc_create(nat->msc_ip, nat->msc_port);
-	if (!msc_con) {
+	nat->msc_con = bsc_msc_create(nat->msc_ip, nat->msc_port, 0);
+	if (!nat->msc_con) {
 		fprintf(stderr, "Creating a bsc_msc_connection failed.\n");
 		exit(1);
 	}
 
-	msc_con->connection_loss = msc_connection_was_lost;
-	msc_con->write_queue.read_cb = ipaccess_msc_read_cb;
-	msc_con->write_queue.write_cb = ipaccess_msc_write_cb;;
-	bsc_msc_connect(msc_con);
+	nat->msc_con->connection_loss = msc_connection_was_lost;
+	nat->msc_con->write_queue.read_cb = ipaccess_msc_read_cb;
+	nat->msc_con->write_queue.write_cb = ipaccess_msc_write_cb;;
+	bsc_msc_connect(nat->msc_con);
 
 	/* wait for the BSC */
 	if (listen_for_bsc(&bsc_listen, &local_addr, 5000) < 0) {
@@ -883,6 +1135,11 @@ int main(int argc, char** argv)
 	signal(SIGUSR1, &signal_handler);
 	signal(SIGPIPE, SIG_IGN);
 
+	/* recycle timer */
+	sccp_close.cb = sccp_close_unconfirmed;
+	sccp_close.data = NULL;
+	bsc_schedule_timer(&sccp_close, SCCP_CLOSE_TIME, 0);
+
 	while (1) {
 		bsc_select_main(0);
 	}

openbsc/src/nat/bsc_nat_utils.c

@@ -46,6 +46,8 @@ struct bsc_nat *bsc_nat_alloc(void)
 	INIT_LLIST_HEAD(&nat->sccp_connections);
 	INIT_LLIST_HEAD(&nat->bsc_connections);
 	INIT_LLIST_HEAD(&nat->bsc_configs);
+	INIT_LLIST_HEAD(&nat->access_lists);
+
 	nat->stats.sccp.conn = counter_alloc("nat.sccp.conn");
 	nat->stats.sccp.calls = counter_alloc("nat.sccp.calls");
 	nat->stats.bsc.reconn = counter_alloc("nat.bsc.conn");
@@ -53,6 +55,9 @@ struct bsc_nat *bsc_nat_alloc(void)
 	nat->stats.msc.reconn = counter_alloc("nat.msc.conn");
 	nat->msc_ip = talloc_strdup(nat, "127.0.0.1");
 	nat->msc_port = 5000;
+	nat->auth_timeout = 2;
+	nat->ping_timeout = 20;
+	nat->pong_timeout = 5;
 	return nat;
 }
 
@@ -70,6 +75,7 @@ struct bsc_connection *bsc_connection_alloc(struct bsc_nat *nat)
 		return NULL;
 
 	con->nat = nat;
+	write_queue_init(&con->write_queue, 100);
 	return con;
 }
 
@@ -99,7 +105,7 @@ void sccp_connection_destroy(struct sccp_connections *conn)
 	LOGP(DNAT, LOGL_DEBUG, "Destroy 0x%x <-> 0x%x mapping for con %p\n",
 	     sccp_src_ref_to_int(&conn->real_ref),
 	     sccp_src_ref_to_int(&conn->patched_ref), conn->bsc);
-	bsc_mgcp_clear(conn);
+	bsc_mgcp_dlcx(conn);
 	llist_del(&conn->list_entry);
 	talloc_free(conn);
 }
@@ -127,7 +133,11 @@ struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg, i
 
 	data_length = TLVP_LEN(&tp, GSM0808_IE_CELL_IDENTIFIER_LIST);
 	data = TLVP_VAL(&tp, GSM0808_IE_CELL_IDENTIFIER_LIST);
-	if (data[0] !=  CELL_IDENT_LAC) {
+
+	/* No need to try a different BSS */
+	if (data[0] == CELL_IDENT_BSS) {
+		return NULL;	
+	} else if (data[0] != CELL_IDENT_LAC) {
 		LOGP(DNAT, LOGL_ERROR, "Unhandled cell ident discrminator: %d\n", data[0]);
 		return NULL;
 	}
@@ -185,3 +195,297 @@ int bsc_write(struct bsc_connection *bsc, struct msgb *msg, int proto)
 	return 0;
 }
 
+static int lst_check_allow(struct bsc_nat_acc_lst *lst, const char *mi_string)
+{
+	struct bsc_nat_acc_lst_entry *entry;
+
+	llist_for_each_entry(entry, &lst->fltr_list, list) {
+		if (!entry->imsi_allow)
+			continue;
+		if (regexec(&entry->imsi_allow_re, mi_string, 0, NULL, 0) == 0)
+			return 0;
+	}
+
+	return 1;
+}
+
+static int lst_check_deny(struct bsc_nat_acc_lst *lst, const char *mi_string)
+{
+	struct bsc_nat_acc_lst_entry *entry;
+
+	llist_for_each_entry(entry, &lst->fltr_list, list) {
+		if (!entry->imsi_deny)
+			continue;
+		if (regexec(&entry->imsi_deny_re, mi_string, 0, NULL, 0) == 0)
+			return 0;
+	}
+
+	return 1;
+}
+
+/* apply white/black list */
+static int auth_imsi(struct bsc_connection *bsc, const char *mi_string)
+{
+	/*
+	 * Now apply blacklist/whitelist of the BSC and the NAT.
+	 * 1.) Reject if the IMSI is not allowed at the BSC
+	 * 2.) Allow directly if the IMSI is allowed at the BSC
+	 * 3.) Reject if the IMSI not allowed at the global level.
+	 * 4.) Allow directly if the IMSI is allowed at the global level
+	 */
+	struct bsc_nat_acc_lst *nat_lst = NULL;
+	struct bsc_nat_acc_lst *bsc_lst = NULL;
+
+	bsc_lst = bsc_nat_acc_lst_find(bsc->nat, bsc->cfg->acc_lst_name);
+	nat_lst = bsc_nat_acc_lst_find(bsc->nat, bsc->nat->acc_lst_name);
+
+
+	if (bsc_lst) {
+		/* 1. BSC deny */
+		if (lst_check_deny(bsc_lst, mi_string) == 0) {
+			LOGP(DNAT, LOGL_ERROR,
+			     "Filtering %s by imsi_deny on bsc nr: %d.\n", mi_string, bsc->cfg->nr);
+			return -2;
+		}
+
+		/* 2. BSC allow */
+		if (lst_check_allow(bsc_lst, mi_string) == 0)
+			return 0;
+	}
+
+	/* 3. NAT deny */
+	if (nat_lst) {
+		if (lst_check_deny(nat_lst, mi_string) == 0) {
+			LOGP(DNAT, LOGL_ERROR,
+			     "Filtering %s by nat imsi_deny on bsc nr: %d.\n", mi_string, bsc->cfg->nr);
+			return -3;
+		}
+	}
+
+	return 0;
+}
+
+static int _cr_check_loc_upd(struct bsc_connection *bsc, uint8_t *data, unsigned int length)
+{
+	u_int8_t mi_type;
+	struct gsm48_loc_upd_req *lu;
+	char mi_string[GSM48_MI_SIZE];
+
+	if (length < sizeof(*lu)) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "LU does not fit. Length is %d \n", length);
+		return -1;
+	}
+
+	lu = (struct gsm48_loc_upd_req *) data;
+	mi_type = lu->mi[0] & GSM_MI_TYPE_MASK;
+
+	/*
+	 * We can only deal with the IMSI. This will fail for a phone that
+	 * will send the TMSI of a previous network to us.
+	 */
+	if (mi_type != GSM_MI_TYPE_IMSI)
+		return 0;
+
+	gsm48_mi_to_string(mi_string, sizeof(mi_string), lu->mi, lu->mi_len);
+	return auth_imsi(bsc, mi_string);
+}
+
+static int _cr_check_cm_serv_req(struct bsc_connection *bsc, uint8_t *data, unsigned int length)
+{
+	static const uint32_t classmark_offset =
+				offsetof(struct gsm48_service_request, classmark);
+
+	char mi_string[GSM48_MI_SIZE];
+	uint8_t mi_type;
+	int rc;
+	struct gsm48_service_request *req;
+
+	/* unfortunately in Phase1 the classmark2 length is variable */
+
+	if (length < sizeof(*req)) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "CM Serv Req does not fit. Length is %d\n", length);
+		return -1;
+	}
+
+	req = (struct gsm48_service_request *) data;
+	rc = gsm48_extract_mi((uint8_t *) &req->classmark,
+			      length - classmark_offset, mi_string, &mi_type);
+	if (rc < 0) {
+		LOGP(DNAT, LOGL_ERROR, "Failed to parse the classmark2/mi. error: %d\n", rc);
+		return -1;
+	}
+
+	/* we have to let the TMSI or such pass */
+	if (mi_type != GSM_MI_TYPE_IMSI)
+		return 0;
+
+	return auth_imsi(bsc, mi_string);
+}
+
+static int _cr_check_pag_resp(struct bsc_connection *bsc, uint8_t *data, unsigned int length)
+{
+	struct gsm48_pag_resp *resp;
+	char mi_string[GSM48_MI_SIZE];
+	u_int8_t mi_type;
+
+	if (length < sizeof(*resp)) {
+		LOGP(DNAT, LOGL_ERROR, "PAG RESP does not fit. Length was %d.\n", length);
+		return -1;
+	}
+
+	resp = (struct gsm48_pag_resp *) data;
+	if (gsm48_paging_extract_mi(resp, length, mi_string, &mi_type) < 0) {
+		LOGP(DNAT, LOGL_ERROR, "Failed to extract the MI.\n");
+		return -1;
+	}
+
+	/* we need to let it pass for now */
+	if (mi_type != GSM_MI_TYPE_IMSI)
+		return 0;
+
+	return auth_imsi(bsc, mi_string);
+}
+
+/* Filter out CR data... */
+int bsc_nat_filter_sccp_cr(struct bsc_connection *bsc, struct msgb *msg, struct bsc_nat_parsed *parsed, int *con_type)
+{
+	struct tlv_parsed tp;
+	struct gsm48_hdr *hdr48;
+	int hdr48_len;
+	int len;
+
+	*con_type = NAT_CON_TYPE_NONE;
+
+	if (parsed->gsm_type != BSS_MAP_MSG_COMPLETE_LAYER_3) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "Rejecting CR message due wrong GSM Type %d\n", parsed->gsm_type);
+		return -1;
+	}
+
+	/* the parsed has had some basic l3 length check */
+	len = msg->l3h[1];
+	if (msgb_l3len(msg) - 3 < len) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "The CR Data has not enough space...\n");
+		return -1;
+	}
+
+	msg->l4h = &msg->l3h[3];
+	len -= 1;
+
+	tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l4h, len, 0, 0);
+
+	if (!TLVP_PRESENT(&tp, GSM0808_IE_LAYER_3_INFORMATION)) {
+		LOGP(DNAT, LOGL_ERROR, "CR Data does not contain layer3 information.\n");
+		return -1;
+	}
+
+	hdr48_len = TLVP_LEN(&tp, GSM0808_IE_LAYER_3_INFORMATION);
+
+	if (hdr48_len < sizeof(*hdr48)) {
+		LOGP(DNAT, LOGL_ERROR, "GSM48 header does not fit.\n");
+		return -1;
+	}
+
+	hdr48 = (struct gsm48_hdr *) TLVP_VAL(&tp, GSM0808_IE_LAYER_3_INFORMATION);
+
+	if (hdr48->proto_discr == GSM48_PDISC_MM &&
+	    hdr48->msg_type == GSM48_MT_MM_LOC_UPD_REQUEST) {
+		*con_type = NAT_CON_TYPE_LU;
+		return _cr_check_loc_upd(bsc, &hdr48->data[0], hdr48_len - sizeof(*hdr48));
+	} else if (hdr48->proto_discr == GSM48_PDISC_MM &&
+		  hdr48->msg_type == GSM48_MT_MM_CM_SERV_REQ) {
+		*con_type = NAT_CON_TYPE_CM_SERV_REQ;
+		return _cr_check_cm_serv_req(bsc, &hdr48->data[0], hdr48_len - sizeof(*hdr48));
+	} else if (hdr48->proto_discr == GSM48_PDISC_RR &&
+		   hdr48->msg_type == GSM48_MT_RR_PAG_RESP) {
+		*con_type = NAT_CON_TYPE_PAG_RESP;
+		return _cr_check_pag_resp(bsc, &hdr48->data[0], hdr48_len - sizeof(*hdr48));
+	} else {
+		/* We only want to filter the above, let other things pass */
+		*con_type = NAT_CON_TYPE_OTHER;
+		return 0;
+	}
+}
+
+void bsc_parse_reg(void *ctx, regex_t *reg, char **imsi, int argc, const char **argv)
+{
+	if (*imsi) {
+		talloc_free(*imsi);
+		*imsi = NULL;
+	}
+	regfree(reg);
+
+	if (argc > 0) {
+		*imsi = talloc_strdup(ctx, argv[0]);
+		regcomp(reg, argv[0], 0);
+	}
+}
+
+static const char *con_types [] = {
+	[NAT_CON_TYPE_NONE] = "n/a",
+	[NAT_CON_TYPE_LU] = "Location Update",
+	[NAT_CON_TYPE_CM_SERV_REQ] = "CM Serv Req",
+	[NAT_CON_TYPE_PAG_RESP] = "Paging Response",
+	[NAT_CON_TYPE_LOCAL_REJECT] = "Local Reject",
+	[NAT_CON_TYPE_OTHER] = "Other",
+};
+
+const char *bsc_con_type_to_string(int type)
+{
+	return con_types[type];
+}
+
+struct bsc_nat_acc_lst *bsc_nat_acc_lst_find(struct bsc_nat *nat, const char *name)
+{
+	struct bsc_nat_acc_lst *lst;
+
+	if (!name)
+		return NULL;
+
+	llist_for_each_entry(lst, &nat->access_lists, list)
+		if (strcmp(lst->name, name) == 0)
+			return lst;
+
+	return NULL;
+}
+
+struct bsc_nat_acc_lst *bsc_nat_acc_lst_get(struct bsc_nat *nat, const char *name)
+{
+	struct bsc_nat_acc_lst *lst;
+
+	lst = bsc_nat_acc_lst_find(nat, name);
+	if (lst)
+		return lst;
+
+	lst = talloc_zero(nat, struct bsc_nat_acc_lst);
+	if (!lst) {
+		LOGP(DNAT, LOGL_ERROR, "Failed to allocate access list");
+		return NULL;
+	}
+
+	INIT_LLIST_HEAD(&lst->fltr_list);
+	lst->name = talloc_strdup(lst, name);
+	llist_add_tail(&lst->list, &nat->access_lists);
+	return lst;
+}
+
+void bsc_nat_acc_lst_delete(struct bsc_nat_acc_lst *lst)
+{
+	llist_del(&lst->list);
+	talloc_free(lst);
+}
+
+struct bsc_nat_acc_lst_entry *bsc_nat_acc_lst_entry_create(struct bsc_nat_acc_lst *lst)
+{
+	struct bsc_nat_acc_lst_entry *entry;
+
+	entry = talloc_zero(lst, struct bsc_nat_acc_lst_entry);
+	if (!entry)
+		return NULL;
+
+	llist_add_tail(&entry->list, &lst->fltr_list);
+	return entry;
+}

openbsc/src/nat/bsc_nat_vty.c

@@ -24,6 +24,7 @@
 #include <vty/vty.h>
 
 #include <openbsc/bsc_nat.h>
+#include <openbsc/bsc_msc.h>
 #include <openbsc/gsm_04_08.h>
 #include <openbsc/mgcp.h>
 #include <openbsc/vty.h>
@@ -48,15 +49,40 @@ static struct cmd_node bsc_node = {
 	1,
 };
 
+static void write_acc_lst(struct vty *vty, struct bsc_nat_acc_lst *lst)
+{
+	struct bsc_nat_acc_lst_entry *entry;
+
+	llist_for_each_entry(entry, &lst->fltr_list, list) {
+		if (entry->imsi_allow)
+			vty_out(vty, " access-list %s imsi-allow %s%s",
+				lst->name, entry->imsi_allow, VTY_NEWLINE);
+		if (entry->imsi_deny)
+			vty_out(vty, " access-list %s imsi-deny %s%s",
+				lst->name, entry->imsi_deny, VTY_NEWLINE);
+	}
+}
+
 static int config_write_nat(struct vty *vty)
 {
+	struct bsc_nat_acc_lst *lst;
+
 	vty_out(vty, "nat%s", VTY_NEWLINE);
-	if (_nat->imsi_allow)
-		vty_out(vty, " imsi allow %s%s", _nat->imsi_allow, VTY_NEWLINE);
-	if (_nat->imsi_deny)
-		vty_out(vty, " insi deny %s%s", _nat->imsi_deny, VTY_NEWLINE);
 	vty_out(vty, " msc ip %s%s", _nat->msc_ip, VTY_NEWLINE);
 	vty_out(vty, " msc port %d%s", _nat->msc_port, VTY_NEWLINE);
+	vty_out(vty, " timeout auth %d%s", _nat->auth_timeout, VTY_NEWLINE);
+	vty_out(vty, " timeout ping %d%s", _nat->ping_timeout, VTY_NEWLINE);
+	vty_out(vty, " timeout pong %d%s", _nat->pong_timeout, VTY_NEWLINE);
+	if (_nat->token)
+		vty_out(vty, " token %s%s", _nat->token, VTY_NEWLINE);
+	vty_out(vty, " ip-tos %d%s", _nat->bsc_ip_tos, VTY_NEWLINE);
+	if (_nat->acc_lst_name)
+		vty_out(vty, " access-list-name %s%s", _nat->acc_lst_name, VTY_NEWLINE);
+
+	llist_for_each_entry(lst, &_nat->access_lists, list) {
+		write_acc_lst(vty, lst);
+	}
+
 	return CMD_SUCCESS;
 }
 
@@ -65,10 +91,11 @@ static void config_write_bsc_single(struct vty *vty, struct bsc_config *bsc)
 	vty_out(vty, " bsc %u%s", bsc->nr, VTY_NEWLINE);
 	vty_out(vty, "  token %s%s", bsc->token, VTY_NEWLINE);
 	vty_out(vty, "  location_area_code %u%s", bsc->lac, VTY_NEWLINE);
-	if (bsc->imsi_allow)
-		vty_out(vty, "   imsi allow %s%s", bsc->imsi_allow, VTY_NEWLINE);
-	if (bsc->imsi_deny)
-		vty_out(vty, "   imsi deny %s%s", bsc->imsi_deny, VTY_NEWLINE);
+	vty_out(vty, "  paging forbidden %d%s", bsc->forbid_paging, VTY_NEWLINE);
+	if (bsc->description)
+		vty_out(vty, "  description %s%s", bsc->description, VTY_NEWLINE);
+	if (bsc->acc_lst_name)
+		vty_out(vty, "  access-list-name %s%s", bsc->acc_lst_name, VTY_NEWLINE);
 }
 
 static int config_write_bsc(struct vty *vty)
@@ -85,13 +112,18 @@ DEFUN(show_sccp, show_sccp_cmd, "show sccp connections",
       SHOW_STR "Display information about current SCCP connections")
 {
 	struct sccp_connections *con;
+	vty_out(vty, "Listing all opening SCCP connections%s", VTY_NEWLINE);
+
 	llist_for_each_entry(con, &_nat->sccp_connections, list_entry) {
-		vty_out(vty, "SCCP for BSC: Nr: %d lac: %d BSC ref: 0x%x Local ref: 0x%x MSC/BSC mux: 0x%x/0x%x%s",
+		vty_out(vty, "For BSC Nr: %d lac: %d; BSC ref: 0x%x; MUX ref: 0x%x; Network has ref: %d ref: 0x%x MSC/BSC mux: 0x%x/0x%x type: %s%s",
 			con->bsc->cfg ? con->bsc->cfg->nr : -1,
 			con->bsc->cfg ? con->bsc->cfg->lac : -1,
 			sccp_src_ref_to_int(&con->real_ref),
 			sccp_src_ref_to_int(&con->patched_ref),
+			con->has_remote_ref,
+			sccp_src_ref_to_int(&con->remote_ref),
 			con->msc_timeslot, con->bsc_timeslot,
+			bsc_con_type_to_string(con->con_type),
 			VTY_NEWLINE);
 	}
 
@@ -107,7 +139,7 @@ DEFUN(show_bsc, show_bsc_cmd, "show bsc connections",
 
 	llist_for_each_entry(con, &_nat->bsc_connections, list_entry) {
 		getpeername(con->write_queue.bfd.fd, (struct sockaddr *) &sock, &len);
-		vty_out(vty, "BSC lac: %d, %d auth: %d fd: %d peername: %s%s",
+		vty_out(vty, "BSC nr: %d lac: %d auth: %d fd: %d peername: %s%s",
 			con->cfg ? con->cfg->nr : -1,
 			con->cfg ? con->cfg->lac : -1,
 			con->authenticated, con->write_queue.bfd.fd,
@@ -117,17 +149,23 @@ DEFUN(show_bsc, show_bsc_cmd, "show bsc connections",
 	return CMD_SUCCESS;
 }
 
-DEFUN(show_bsc_cfg, show_bsc_cfg_cmd, "bsc config show",
-      "Display information about known BSC configs")
+DEFUN(show_bsc_cfg, show_bsc_cfg_cmd, "show bsc config",
+      SHOW_STR "Display information about known BSC configs")
 {
 	struct bsc_config *conf;
 	llist_for_each_entry(conf, &_nat->bsc_configs, entry) {
 		vty_out(vty, "BSC token: '%s' lac: %u nr: %u%s",
 			conf->token, conf->lac, conf->nr, VTY_NEWLINE);
-		vty_out(vty, " imsi_allow: '%s' imsi_deny: '%s'%s",
-			conf->imsi_allow ? conf->imsi_allow: "any",
-			conf->imsi_deny  ? conf->imsi_deny : "none",
-			VTY_NEWLINE);
+		if (conf->acc_lst_name)
+			vty_out(vty, " access-list: %s%s",
+				conf->acc_lst_name, VTY_NEWLINE);
+		vty_out(vty, " paging forbidden: %d%s",
+			conf->forbid_paging, VTY_NEWLINE);
+		if (conf->description)
+			vty_out(vty, " description: %s%s", conf->description, VTY_NEWLINE);
+		else
+			vty_out(vty, " No description.%s", VTY_NEWLINE);
+
 	}
 
 	return CMD_SUCCESS;
@@ -135,11 +173,16 @@ DEFUN(show_bsc_cfg, show_bsc_cfg_cmd, "bsc config show",
 
 DEFUN(show_stats,
       show_stats_cmd,
-      "show statistics",
-	SHOW_STR "Display network statistics\n")
+      "show statistics [NR]",
+	SHOW_STR "Display network statistics")
 {
 	struct bsc_config *conf;
 
+	int nr = -1;
+
+	if (argc == 1)
+		nr = atoi(argv[0]);
+
 	vty_out(vty, "NAT statistics%s", VTY_NEWLINE);
 	vty_out(vty, " SCCP Connections %lu total, %lu calls%s",
 		counter_get(_nat->stats.sccp.conn),
@@ -151,6 +194,9 @@ DEFUN(show_stats,
 		counter_get(_nat->stats.bsc.auth_fail), VTY_NEWLINE);
 
 	llist_for_each_entry(conf, &_nat->bsc_configs, entry) {
+		if (argc == 1 && nr != conf->nr)
+			continue;
+
 		vty_out(vty, " BSC lac: %d nr: %d%s",
 			conf->lac, conf->nr, VTY_NEWLINE);
 		vty_out(vty, "   SCCP Connnections %lu total, %lu calls%s",
@@ -163,6 +209,40 @@ DEFUN(show_stats,
 	return CMD_SUCCESS;
 }
 
+DEFUN(show_msc,
+      show_msc_cmd,
+      "show msc connection",
+      SHOW_STR "Show the status of the MSC connection.")
+{
+	if (!_nat->msc_con) {
+		vty_out(vty, "The MSC is not yet configured.\n");
+		return CMD_WARNING;
+	}
+
+	vty_out(vty, "MSC on %s:%d is connected: %d%s\n",
+		_nat->msc_con->ip, _nat->msc_con->port,
+		_nat->msc_con->is_connected, VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+DEFUN(close_bsc,
+      close_bsc_cmd,
+      "close bsc connection BSC_NR",
+      "Close the connection with the BSC identified by the config number.")
+{
+	struct bsc_connection *bsc;
+	int bsc_nr = atoi(argv[0]);
+
+	llist_for_each_entry(bsc, &_nat->bsc_connections, list_entry) {
+		if (!bsc->cfg || bsc->cfg->nr != bsc_nr)
+			continue;
+		bsc_close_connection(bsc);
+		break;
+	}
+
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_nat, cfg_nat_cmd, "nat", "Configute the NAT")
 {
 	vty->index = _nat;
@@ -171,43 +251,9 @@ DEFUN(cfg_nat, cfg_nat_cmd, "nat", "Configute the NAT")
 	return CMD_SUCCESS;
 }
 
-static void parse_reg(void *ctx, regex_t *reg, char **imsi, int argc, const char **argv)
-{
-	if (*imsi) {
-		talloc_free(*imsi);
-		*imsi = NULL;
-	}
-	regfree(reg);
-
-	if (argc > 0) {
-		*imsi = talloc_strdup(ctx, argv[0]);
-		regcomp(reg, argv[0], 0);
-	}
-}
-
-DEFUN(cfg_nat_imsi_allow,
-      cfg_nat_imsi_allow_cmd,
-      "imsi allow [REGEXP]",
-      "Allow matching IMSIs to talk to the MSC. "
-      "The defualt is to allow everyone.")
-{
-	parse_reg(_nat, &_nat->imsi_allow_re, &_nat->imsi_allow, argc, argv);
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_nat_imsi_deny,
-      cfg_nat_imsi_deny_cmd,
-      "imsi deny [REGEXP]",
-      "Deny matching IMSIs to talk to the MSC. "
-      "The defualt is to not deny.")
-{
-	parse_reg(_nat, &_nat->imsi_deny_re, &_nat->imsi_deny, argc, argv);
-	return CMD_SUCCESS;
-}
-
 DEFUN(cfg_nat_msc_ip,
       cfg_nat_msc_ip_cmd,
-      "msc ip IP",
+      "msc ip A.B.C.D",
       "Set the IP address of the MSC.")
 {
 	bsc_nat_set_msc_ip(_nat, argv[0]);
@@ -223,8 +269,65 @@ DEFUN(cfg_nat_msc_port,
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_nat_auth_time,
+      cfg_nat_auth_time_cmd,
+      "timeout auth <1-256>",
+      "The time to wait for an auth response.")
+{
+	_nat->auth_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_ping_time,
+      cfg_nat_ping_time_cmd,
+      "timeout ping NR",
+      "Send a ping every NR seconds. Negative to disable.")
+{
+	_nat->ping_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_pong_time,
+      cfg_nat_pong_time_cmd,
+      "timeout pong NR",
+      "Wait NR seconds for the PONG response. Should be smaller than ping.")
+{
+	_nat->pong_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_token, cfg_nat_token_cmd,
+      "token TOKEN",
+      "Set a token for the NAT")
+{
+	if (_nat->token)
+		talloc_free(_nat->token);
+	_nat->token = talloc_strdup(_nat, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_bsc_ip_tos, cfg_nat_bsc_ip_tos_cmd,
+      "ip-tos <0-255>",
+      "Set the IP_TOS for the BSCs to use\n" "Set the IP_TOS attribute")
+{
+	_nat->bsc_ip_tos = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_acc_lst_name,
+      cfg_nat_acc_lst_name_cmd,
+      "access-list-name NAME",
+      "Set the name of the access list to use.\n"
+      "The name of the to be used access list.")
+{
+	if (_nat->acc_lst_name)
+		talloc_free(_nat->acc_lst_name);
+	_nat->acc_lst_name = talloc_strdup(_nat, argv[0]);
+	return CMD_SUCCESS;
+}
+
 /* per BSC configuration */
-DEFUN(cfg_bsc, cfg_bsc_cmd, "bsc BSC_NR", "Select a BSC to configure\n")
+DEFUN(cfg_bsc, cfg_bsc_cmd, "bsc BSC_NR", "Select a BSC to configure")
 {
 	int bsc_nr = atoi(argv[0]);
 	struct bsc_config *bsc;
@@ -259,19 +362,13 @@ DEFUN(cfg_bsc_token, cfg_bsc_token_cmd, "token TOKEN", "Set the token")
 }
 
 DEFUN(cfg_bsc_lac, cfg_bsc_lac_cmd, "location_area_code <0-65535>",
-      "Set the Location Area Code (LAC) of this BSC\n")
+      "Set the Location Area Code (LAC) of this BSC")
 {
 	struct bsc_config *tmp;
 	struct bsc_config *conf = vty->index;
 
 	int lac = atoi(argv[0]);
 
-	if (lac < 0 || lac > 0xffff) {
-		vty_out(vty, "%% LAC %d is not in the valid range (0-65535)%s",
-			lac, VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	if (lac == GSM_LAC_RESERVED_DETACHED || lac == GSM_LAC_RESERVED_ALL_BTS) {
 		vty_out(vty, "%% LAC %d is reserved by GSM 04.08%s",
 			lac, VTY_NEWLINE);
@@ -291,27 +388,123 @@ DEFUN(cfg_bsc_lac, cfg_bsc_lac_cmd, "location_area_code <0-65535>",
 	return CMD_SUCCESS;
 }
 
-DEFUN(cfg_bsc_imsi_allow,
-      cfg_bsc_imsi_allow_cmd,
-      "imsi allow [REGEXP]",
-      "Allow IMSIs with the following network to talk to the MSC."
-      "The default is to allow everyone)")
+DEFUN(cfg_lst_imsi_allow,
+      cfg_lst_imsi_allow_cmd,
+      "access-list NAME imsi-allow [REGEXP]",
+      "Allow IMSIs matching the REGEXP\n"
+      "The name of the access-list\n"
+      "The regexp of allowed IMSIs\n")
 {
-	struct bsc_config *conf = vty->index;
+	struct bsc_nat_acc_lst *acc;
+	struct bsc_nat_acc_lst_entry *entry;
 
-	parse_reg(conf, &conf->imsi_allow_re, &conf->imsi_allow, argc, argv);
+	acc = bsc_nat_acc_lst_get(_nat, argv[0]);
+	if (!acc)
+		return CMD_WARNING;
+
+	entry = bsc_nat_acc_lst_entry_create(acc);
+	if (!entry)
+		return CMD_WARNING;
+
+	bsc_parse_reg(acc, &entry->imsi_allow_re, &entry->imsi_allow, argc - 1, &argv[1]);
 	return CMD_SUCCESS;
 }
 
-DEFUN(cfg_bsc_imsi_deny,
-      cfg_bsc_imsi_deny_cmd,
-      "imsi deny [REGEXP]",
-      "Deny IMSIs with the following network to talk to the MSC."
-      "The default is to not deny anyone.)")
+DEFUN(cfg_lst_imsi_deny,
+      cfg_lst_imsi_deny_cmd,
+      "access-list NAME imsi-deny [REGEXP]",
+      "Allow IMSIs matching the REGEXP\n"
+      "The name of the access-list\n"
+      "The regexp of to be denied IMSIs\n")
+{
+	struct bsc_nat_acc_lst *acc;
+	struct bsc_nat_acc_lst_entry *entry;
+
+	acc = bsc_nat_acc_lst_get(_nat, argv[0]);
+	if (!acc)
+		return CMD_WARNING;
+
+	entry = bsc_nat_acc_lst_entry_create(acc);
+	if (!entry)
+		return CMD_WARNING;
+
+	bsc_parse_reg(acc, &entry->imsi_deny_re, &entry->imsi_deny, argc - 1, &argv[1]);
+	return CMD_SUCCESS;
+}
+
+/* naming to follow Zebra... */
+DEFUN(cfg_lst_no,
+      cfg_lst_no_cmd,
+      "no access-list NAME",
+      NO_STR "Remove an access-list by name\n"
+      "The access-list to remove\n")
+{
+	struct bsc_nat_acc_lst *acc;
+	acc = bsc_nat_acc_lst_find(_nat, argv[0]);
+	if (!acc)
+		return CMD_WARNING;
+
+	bsc_nat_acc_lst_delete(acc);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bsc_acc_lst_name,
+      cfg_bsc_acc_lst_name_cmd,
+      "access-list-name NAME",
+      "Set the name of the access list to use.\n"
+      "The name of the to be used access list.")
 {
 	struct bsc_config *conf = vty->index;
 
-	parse_reg(conf, &conf->imsi_deny_re, &conf->imsi_deny, argc, argv);
+	if (conf->acc_lst_name)
+		talloc_free(conf->acc_lst_name);
+	conf->acc_lst_name = talloc_strdup(conf, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bsc_paging,
+      cfg_bsc_paging_cmd,
+      "paging forbidden (0|1)",
+      "Forbid sending PAGING REQUESTS to the BSC.")
+{
+	struct bsc_config *conf = vty->index;
+
+	if (strcmp("1", argv[0]) == 0)
+		conf->forbid_paging = 1;
+	else
+		conf->forbid_paging = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bsc_desc,
+      cfg_bsc_desc_cmd,
+      "description DESC",
+      "Provide a description for the given BSC.")
+{
+	struct bsc_config *conf = vty->index;
+
+	if (conf->description)
+		talloc_free(conf->description);
+	conf->description = talloc_strdup(conf, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(test_regex, test_regex_cmd,
+      "test regex PATTERN STRING",
+      "Check if the string is matching the current pattern.")
+{
+	regex_t reg;
+	char *str = NULL;
+
+	memset(&reg, 0, sizeof(reg));
+	bsc_parse_reg(_nat, &reg, &str, 1, argv);
+
+	vty_out(vty, "String matches allow pattern: %d%s",
+		regexec(&reg, argv[1], 0, NULL, 0) == 0, VTY_NEWLINE);
+
+	talloc_free(str);
+	regfree(&reg);
 	return CMD_SUCCESS;
 }
 
@@ -327,6 +520,9 @@ int bsc_nat_vty_init(struct bsc_nat *nat)
 	install_element(VIEW_NODE, &show_bsc_cmd);
 	install_element(VIEW_NODE, &show_bsc_cfg_cmd);
 	install_element(VIEW_NODE, &show_stats_cmd);
+	install_element(VIEW_NODE, &close_bsc_cmd);
+	install_element(VIEW_NODE, &show_msc_cmd);
+	install_element(VIEW_NODE, &test_regex_cmd);
 
 	openbsc_vty_add_cmds();
 
@@ -334,10 +530,19 @@ int bsc_nat_vty_init(struct bsc_nat *nat)
 	install_element(CONFIG_NODE, &cfg_nat_cmd);
 	install_node(&nat_node, config_write_nat);
 	install_default(NAT_NODE);
-	install_element(NAT_NODE, &cfg_nat_imsi_allow_cmd);
-	install_element(NAT_NODE, &cfg_nat_imsi_deny_cmd);
 	install_element(NAT_NODE, &cfg_nat_msc_ip_cmd);
 	install_element(NAT_NODE, &cfg_nat_msc_port_cmd);
+	install_element(NAT_NODE, &cfg_nat_auth_time_cmd);
+	install_element(NAT_NODE, &cfg_nat_ping_time_cmd);
+	install_element(NAT_NODE, &cfg_nat_pong_time_cmd);
+	install_element(NAT_NODE, &cfg_nat_token_cmd);
+	install_element(NAT_NODE, &cfg_nat_bsc_ip_tos_cmd);
+	install_element(NAT_NODE, &cfg_nat_acc_lst_name_cmd);
+
+	/* access-list */
+	install_element(NAT_NODE, &cfg_lst_imsi_allow_cmd);
+	install_element(NAT_NODE, &cfg_lst_imsi_deny_cmd);
+	install_element(NAT_NODE, &cfg_lst_no_cmd);
 
 	/* BSC subgroups */
 	install_element(NAT_NODE, &cfg_bsc_cmd);
@@ -345,8 +550,9 @@ int bsc_nat_vty_init(struct bsc_nat *nat)
 	install_default(BSC_NODE);
 	install_element(BSC_NODE, &cfg_bsc_token_cmd);
 	install_element(BSC_NODE, &cfg_bsc_lac_cmd);
-	install_element(BSC_NODE, &cfg_bsc_imsi_allow_cmd);
-	install_element(BSC_NODE, &cfg_bsc_imsi_deny_cmd);
+	install_element(BSC_NODE, &cfg_bsc_paging_cmd);
+	install_element(BSC_NODE, &cfg_bsc_desc_cmd);
+	install_element(BSC_NODE, &cfg_bsc_acc_lst_name_cmd);
 
 	mgcp_vty_init();
 

openbsc/src/nat/bsc_sccp.c

@@ -28,6 +28,7 @@
 #include <osmocore/talloc.h>
 
 #include <string.h>
+#include <time.h>
 
 static int equal(struct sccp_source_reference *ref1, struct sccp_source_reference *ref2)
 {
@@ -81,25 +82,51 @@ static int assign_src_local_reference(struct sccp_source_reference *ref, struct
 	return -1;
 }
 
-int create_sccp_src_ref(struct bsc_connection *bsc, struct msgb *msg, struct bsc_nat_parsed *parsed)
+struct sccp_connections *create_sccp_src_ref(struct bsc_connection *bsc,
+					     struct bsc_nat_parsed *parsed)
 {
 	struct sccp_connections *conn;
 
+	/* Some commercial BSCs like to reassign there SRC ref */
+	llist_for_each_entry(conn, &bsc->nat->sccp_connections, list_entry) {
+		if (conn->bsc != bsc)
+			continue;
+		if (memcmp(&conn->real_ref, parsed->src_local_ref, sizeof(conn->real_ref)) != 0)
+			continue;
+
+		/* the BSC has reassigned the SRC ref and we failed to keep track */
+		memset(&conn->remote_ref, 0, sizeof(conn->remote_ref));
+		if (assign_src_local_reference(&conn->patched_ref, bsc->nat) != 0) {
+			LOGP(DNAT, LOGL_ERROR, "BSC %d reused src ref: %d and we failed to generate a new id.\n",
+			     bsc->cfg->nr, sccp_src_ref_to_int(parsed->src_local_ref));
+			bsc_mgcp_dlcx(conn);
+			llist_del(&conn->list_entry);
+			talloc_free(conn);
+			return NULL;
+		} else {
+			clock_gettime(CLOCK_MONOTONIC, &conn->creation_time);
+			bsc_mgcp_dlcx(conn);
+			return conn;
+		}
+	}
+
+
 	conn = talloc_zero(bsc->nat, struct sccp_connections);
 	if (!conn) {
 		LOGP(DNAT, LOGL_ERROR, "Memory allocation failure.\n");
-		return -1;
+		return NULL;
 	}
 
 	conn->bsc = bsc;
+	clock_gettime(CLOCK_MONOTONIC, &conn->creation_time);
 	conn->real_ref = *parsed->src_local_ref;
 	if (assign_src_local_reference(&conn->patched_ref, bsc->nat) != 0) {
 		LOGP(DNAT, LOGL_ERROR, "Failed to assign a ref.\n");
 		talloc_free(conn);
-		return -1;
+		return NULL;
 	}
 
-	bsc_mgcp_clear(conn);
+	bsc_mgcp_init(conn);
 	llist_add_tail(&conn->list_entry, &bsc->nat->sccp_connections);
 	counter_inc(bsc->cfg->stats.sccp.conn);
 	counter_inc(bsc->cfg->nat->stats.sccp.conn);
@@ -108,7 +135,7 @@ int create_sccp_src_ref(struct bsc_connection *bsc, struct msgb *msg, struct bsc
 	     sccp_src_ref_to_int(&conn->real_ref),
 	     sccp_src_ref_to_int(&conn->patched_ref), bsc);
 
-	return 0;
+	return conn;
 }
 
 int update_sccp_src_ref(struct sccp_connections *sccp, struct bsc_nat_parsed *parsed)
@@ -119,6 +146,7 @@ int update_sccp_src_ref(struct sccp_connections *sccp, struct bsc_nat_parsed *pa
 	}
 
 	sccp->remote_ref = *parsed->src_local_ref;
+	sccp->has_remote_ref = 1;
 	LOGP(DNAT, LOGL_DEBUG, "Updating 0x%x to remote 0x%x on %p\n",
 	     sccp_src_ref_to_int(&sccp->patched_ref),
 	     sccp_src_ref_to_int(&sccp->remote_ref), sccp->bsc);
@@ -182,11 +210,14 @@ struct sccp_connections *patch_sccp_src_ref_to_bsc(struct msgb *msg,
  */
 struct sccp_connections *patch_sccp_src_ref_to_msc(struct msgb *msg,
 						   struct bsc_nat_parsed *parsed,
-						   struct bsc_nat *nat)
+						   struct bsc_connection *bsc)
 {
 	struct sccp_connections *conn;
 
-	llist_for_each_entry(conn, &nat->sccp_connections, list_entry) {
+	llist_for_each_entry(conn, &bsc->nat->sccp_connections, list_entry) {
+		if (conn->bsc != bsc)
+			continue;
+
 		if (parsed->src_local_ref) {
 			if (equal(parsed->src_local_ref, &conn->real_ref)) {
 				*parsed->src_local_ref = conn->patched_ref;

openbsc/src/paging.c

@@ -381,7 +381,7 @@ void paging_request_stop(struct gsm_bts *_bts, struct gsm_subscriber *subscr,
 			break;
 
 		/* Stop paging */
-                if (bts != _bts)
+		if (bts != _bts)
 			_paging_request_stop(bts, subscr, NULL);
 	} while (1);
 }

openbsc/src/rest_octets.c

@@ -316,8 +316,16 @@ static int append_gprs_cell_opt(struct bitvec *bv,
 	bitvec_set_bit(bv, 1);
 	bitvec_set_uint(bv, gco->bs_cv_max, 4);
 
-	/* hard-code no PAN_{DEC,INC,MAX} */
-	bitvec_set_bit(bv, 0);
+	if (0) {
+		/* hard-code no PAN_{DEC,INC,MAX} */
+		bitvec_set_bit(bv, 0);
+	} else {
+		/* copied from ip.access BSC protocol trace */
+		bitvec_set_bit(bv, 1);
+		bitvec_set_uint(bv, 1, 3);	/* DEC */
+		bitvec_set_uint(bv, 1, 3);	/* INC */
+		bitvec_set_uint(bv, 15, 3);	/* MAX */
+	}
 
 	if (!gco->ext_info_present) {
 		/* no extension information */

openbsc/src/sccp/sccp.c

@@ -81,7 +81,7 @@ static struct sccp_data_callback *_find_ssn(u_int8_t ssn)
 	/* need to add one */
 	cb = talloc_zero(tall_sccp_ctx, struct sccp_data_callback);
 	if (!cb) {
-		DEBUGP(DSCCP, "Failed to allocate sccp callback.\n");
+		LOGP(DSCCP, LOGL_ERROR, "Failed to allocate sccp callback.\n");
 		return NULL;
 	}
 
@@ -108,13 +108,13 @@ static int copy_address(struct sccp_address *addr, u_int8_t offset, struct msgb
 	u_int8_t length;
 
 	if (room <= 0) {
-		DEBUGP(DSCCP, "Not enough room for an address: %u\n", room);
+		LOGP(DSCCP, LOGL_ERROR, "Not enough room for an address: %u\n", room);
 		return -1;
 	}
 
 	length = msgb->l2h[offset];
 	if (room <= length) {
-		DEBUGP(DSCCP, "Not enough room for optional data %u %u\n", room, length);
+		LOGP(DSCCP, LOGL_ERROR, "Not enough room for optional data %u %u\n", room, length);
 		return -1;
 	}
 
@@ -122,7 +122,7 @@ static int copy_address(struct sccp_address *addr, u_int8_t offset, struct msgb
 	party = (struct sccp_called_party_address *)(msgb->l2h + offset + 1);
 	if (party->point_code_indicator) {
 		if (length <= read + 2) {
-		    DEBUGP(DSCCP, "POI does not fit %u\n", length);
+		    LOGP(DSCCP, LOGL_ERROR, "POI does not fit %u\n", length);
 		    return -1;
 		}
 
@@ -133,7 +133,7 @@ static int copy_address(struct sccp_address *addr, u_int8_t offset, struct msgb
 
 	if (party->ssn_indicator) {
 		if (length <= read + 1) {
-		    DEBUGP(DSCCP, "SSN does not fit %u\n", length);
+		    LOGP(DSCCP, LOGL_ERROR, "SSN does not fit %u\n", length);
 		    return -1;
 		}
 
@@ -142,7 +142,7 @@ static int copy_address(struct sccp_address *addr, u_int8_t offset, struct msgb
 	}
 
 	if (party->global_title_indicator) {
-		DEBUGP(DSCCP, "GTI not supported %u\n", *(u_int8_t *)party);
+		LOGP(DSCCP, LOGL_ERROR, "GTI not supported %u\n", *(u_int8_t *)party);
 		return -1;
 	}
 
@@ -156,7 +156,8 @@ static int check_address(struct sccp_address *addr)
 	if (addr->address.ssn_indicator != 1
 	    || addr->address.global_title_indicator == 1
 	    || addr->address.routing_indicator != 1) {
-		DEBUGP(DSCCP, "Invalid called address according to 08.06: 0x%x 0x%x\n",
+		LOGP(DSCCP, LOGL_ERROR,
+			"Invalid called address according to 08.06: 0x%x 0x%x\n",
 			*(u_int8_t *)&addr->address, addr->ssn);
 		return -1;
 	}
@@ -176,7 +177,7 @@ static int _sccp_parse_optional_data(const int offset,
 			return 0;
 
 		if (read + 1 >= room) {
-			DEBUGP(DSCCP, "no place for length\n");
+			LOGP(DSCCP, LOGL_ERROR, "no place for length\n");
 			return 0;
 		}
 
@@ -185,7 +186,8 @@ static int _sccp_parse_optional_data(const int offset,
 
 
 		if (room <= read) {
-			DEBUGP(DSCCP, "no space for the data: type: %d read: %d room: %d l2: %d\n",
+			LOGP(DSCCP, LOGL_ERROR,
+			       "no space for the data: type: %d read: %d room: %d l2: %d\n",
 			       type, read, room, msgb_l2len(msgb));
 			return 0;
 		}
@@ -214,7 +216,7 @@ int _sccp_parse_connection_request(struct msgb *msgb, struct sccp_parse_result *
 
 	/* header check */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -224,7 +226,7 @@ int _sccp_parse_connection_request(struct msgb *msgb, struct sccp_parse_result *
 		return -1;
 
 	if (check_address(&result->called) != 0) {
-		DEBUGP(DSCCP, "Invalid called address according to 08.06: 0x%x 0x%x\n",
+		LOGP(DSCCP, LOGL_ERROR, "Invalid called address according to 08.06: 0x%x 0x%x\n",
 			*(u_int8_t *)&result->called.address, result->called.ssn);
 		return -1;
 	}
@@ -236,7 +238,7 @@ int _sccp_parse_connection_request(struct msgb *msgb, struct sccp_parse_result *
 	 */
 	memset(&optional_data, 0, sizeof(optional_data));
 	if (_sccp_parse_optional_data(optional_offset + req->optional_start, msgb, &optional_data) != 0) {
-		DEBUGP(DSCCP, "parsing of optional data failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "parsing of optional data failed.\n");
 		return -1;
 	}
 
@@ -260,14 +262,14 @@ int _sccp_parse_connection_released(struct msgb *msgb, struct sccp_parse_result
 
 	/* we don't have enough size for the struct */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb > header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb > header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
 
 	memset(&optional_data, 0, sizeof(optional_data));
 	if (_sccp_parse_optional_data(optional_offset + rls->optional_start, msgb, &optional_data) != 0) {
-		DEBUGP(DSCCP, "parsing of optional data failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "parsing of optional data failed.\n");
 		return -1;
 	}
 
@@ -295,7 +297,7 @@ int _sccp_parse_connection_refused(struct msgb *msgb, struct sccp_parse_result *
 
 	/* header check */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -306,7 +308,7 @@ int _sccp_parse_connection_refused(struct msgb *msgb, struct sccp_parse_result *
 
 	memset(&optional_data, 0, sizeof(optional_data));
 	if (_sccp_parse_optional_data(optional_offset + ref->optional_start, msgb, &optional_data) != 0) {
-		DEBUGP(DSCCP, "parsing of optional data failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "parsing of optional data failed.\n");
 		return -1;
 	}
 
@@ -333,7 +335,7 @@ int _sccp_parse_connection_confirm(struct msgb *msgb, struct sccp_parse_result *
 
 	/* header check */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -344,7 +346,7 @@ int _sccp_parse_connection_confirm(struct msgb *msgb, struct sccp_parse_result *
 
 	memset(&optional_data, 0, sizeof(optional_data));
 	if (_sccp_parse_optional_data(optional_offset + con->optional_start, msgb, &optional_data) != 0) {
-		DEBUGP(DSCCP, "parsing of optional data failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "parsing of optional data failed.\n");
 		return -1;
 	}
 
@@ -366,7 +368,7 @@ int _sccp_parse_connection_release_complete(struct msgb *msgb, struct sccp_parse
 
 	/* header check */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -387,13 +389,13 @@ int _sccp_parse_connection_dt1(struct msgb *msgb, struct sccp_parse_result *resu
 
 	/* we don't have enough size for the struct */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb > header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb > header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
 
 	if (dt1->segmenting != 0) {
-		DEBUGP(DSCCP, "This packet has segmenting, not supported: %d\n", dt1->segmenting);
+		LOGP(DSCCP, LOGL_ERROR, "This packet has segmenting, not supported: %d\n", dt1->segmenting);
 		return -1;
 	}
 
@@ -401,7 +403,7 @@ int _sccp_parse_connection_dt1(struct msgb *msgb, struct sccp_parse_result *resu
 
 	/* some more  size checks in here */
 	if (msgb_l2len(msgb) < variable_offset + dt1->variable_start + 1) {
-		DEBUGP(DSCCP, "Not enough space for variable start: %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "Not enough space for variable start: %u %u\n",
 			msgb_l2len(msgb), dt1->variable_start);
 		return -1;
 	}
@@ -410,7 +412,7 @@ int _sccp_parse_connection_dt1(struct msgb *msgb, struct sccp_parse_result *resu
 	msgb->l3h = &msgb->l2h[dt1->variable_start + variable_offset + 1];
 
 	if (msgb_l3len(msgb) < result->data_len) {
-		DEBUGP(DSCCP, "Not enough room for the payload: %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "Not enough room for the payload: %u %u\n",
 			msgb_l3len(msgb), result->data_len);
 		return -1;
 	}
@@ -428,7 +430,7 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 	struct sccp_data_unitdata *udt = (struct sccp_data_unitdata *)msgb->l2h;
 
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -438,7 +440,7 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 		return -1;
 
 	if (check_address(&result->called) != 0) {
-		DEBUGP(DSCCP, "Invalid called address according to 08.06: 0x%x 0x%x\n",
+		LOGP(DSCCP, LOGL_ERROR, "Invalid called address according to 08.06: 0x%x 0x%x\n",
 			*(u_int8_t *)&result->called.address, result->called.ssn);
 		return -1;
 	}
@@ -447,13 +449,13 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 		return -1;
 
 	if (check_address(&result->calling) != 0) {
-		DEBUGP(DSCCP, "Invalid called address according to 08.06: 0x%x 0x%x\n",
+		LOGP(DSCCP, LOGL_ERROR, "Invalid called address according to 08.06: 0x%x 0x%x\n",
 			*(u_int8_t *)&result->called.address, result->called.ssn);
 	}
 
 	/* we don't have enough size for the data */
 	if (msgb_l2len(msgb) < data_offset + udt->variable_data + 1) {
-		DEBUGP(DSCCP, "msgb < header + offset %u %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header + offset %u %u %u\n",
 			msgb_l2len(msgb), header_size, udt->variable_data);
 		return -1;
 	}
@@ -463,7 +465,7 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 	result->data_len = msgb_l3len(msgb);
 
 	if (msgb_l3len(msgb) !=  msgb->l3h[-1]) {
-		DEBUGP(DSCCP, "msgb is truncated is: %u should: %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb is truncated is: %u should: %u\n",
 			msgb_l3len(msgb), msgb->l3h[-1]);
 		return -1;
 	}
@@ -478,7 +480,7 @@ static int _sccp_parse_it(struct msgb *msgb, struct sccp_parse_result *result)
 	struct sccp_data_it *it;
 
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -490,6 +492,23 @@ static int _sccp_parse_it(struct msgb *msgb, struct sccp_parse_result *result)
 	return 0;
 }
 
+static int _sccp_parse_err(struct msgb *msgb, struct sccp_parse_result *result)
+{
+	static const u_int32_t header_size = sizeof(struct sccp_proto_err);
+
+	struct sccp_proto_err *err;
+
+	if (msgb_l2len(msgb) < header_size) {
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
+		     msgb_l2len(msgb), header_size);
+		return -1;
+	}
+
+	err = (struct sccp_proto_err *) msgb->l2h;
+	result->data_len = 0;
+	result->destination_local_reference = &err->destination_local_reference;
+	return 0;
+}
 
 /*
  * Send UDT. Currently we have a fixed address...
@@ -501,7 +520,7 @@ static int _sccp_send_data(int class, const struct sockaddr_sccp *in,
 	u_int8_t *data;
 
 	if (msgb_l3len(payload) > 256) {
-		DEBUGP(DSCCP, "The payload is too big for one udt\n");
+		LOGP(DSCCP, LOGL_ERROR, "The payload is too big for one udt\n");
 		return -1;
 	}
 
@@ -546,7 +565,7 @@ static int _sccp_handle_read(struct msgb *msgb)
 
 	cb = _find_ssn(result.called.ssn);
 	if (!cb || !cb->read_cb) {
-		DEBUGP(DSCCP, "No routing for UDT for called SSN: %u\n", result.called.ssn);
+		LOGP(DSCCP, LOGL_ERROR, "No routing for UDT for called SSN: %u\n", result.called.ssn);
 		return -1;
 	}
 
@@ -595,7 +614,7 @@ static int assign_source_local_reference(struct sccp_connection *connection)
 		++last_ref;
 		/* do not use the reversed word and wrap around */
 		if ((last_ref & 0x00FFFFFF) == 0x00FFFFFF) {
-			DEBUGP(DSCCP, "Wrapped searching for a free code\n");
+			LOGP(DSCCP, LOGL_DEBUG, "Wrapped searching for a free code\n");
 			last_ref = 0;
 			++wrapped;
 		}
@@ -606,7 +625,7 @@ static int assign_source_local_reference(struct sccp_connection *connection)
 		}
 	} while (wrapped != 2);
 
-	DEBUGP(DSCCP, "Finding a free reference failed\n");
+	LOGP(DSCCP, LOGL_ERROR, "Finding a free reference failed\n");
 	return -1;
 }
 
@@ -619,7 +638,7 @@ static void _sccp_set_connection_state(struct sccp_connection *connection, int n
 		connection->state_cb(connection, old_state);
 }
 
-static int _sccp_send_refuse(struct sccp_source_reference *src_ref, int cause)
+struct msgb *sccp_create_refuse(struct sccp_source_reference *src_ref, int cause, uint8_t *inp, int length)
 {
 	struct msgb *msgb;
 	struct sccp_connection_refused *ref;
@@ -627,6 +646,11 @@ static int _sccp_send_refuse(struct sccp_source_reference *src_ref, int cause)
 
 	msgb = msgb_alloc_headroom(SCCP_MSG_SIZE,
 				   SCCP_MSG_HEADROOM, "sccp ref");
+	if (!msgb) {
+		LOGP(DSCCP, LOGL_ERROR, "Failed to allocate refusal msg.\n");
+		return NULL;
+	}
+
 	msgb->l2h = &msgb->data[0];
 
 	ref = (struct sccp_connection_refused *) msgb_put(msgb, sizeof(*ref));
@@ -636,40 +660,70 @@ static int _sccp_send_refuse(struct sccp_source_reference *src_ref, int cause)
 	ref->cause = cause;
 	ref->optional_start = 1;
 
+	if (inp) {
+		data = msgb_put(msgb, 1 + 1 + length);
+		data[0] = SCCP_PNC_DATA;
+		data[1] = length;
+		memcpy(&data[2], inp, length);
+	}
+
 	data = msgb_put(msgb, 1);
 	data[0] = SCCP_PNC_END_OF_OPTIONAL;
+	return msgb;
+}
+
+static int _sccp_send_refuse(struct sccp_source_reference *src_ref, int cause)
+{
+	struct msgb *msgb = sccp_create_refuse(src_ref, cause, NULL, 0);
+	if (!msgb)
+		return -1;
 
 	_send_msg(msgb);
 	return 0;
 }
 
-static int _sccp_send_connection_confirm(struct sccp_connection *connection)
+struct msgb *sccp_create_cc(struct sccp_source_reference *src_ref,
+			    struct sccp_source_reference *dst_ref)
 {
 	struct msgb *response;
 	struct sccp_connection_confirm *confirm;
 	u_int8_t *optional_data;
 
-	if (assign_source_local_reference(connection) != 0)
-		return -1;
-
 	response = msgb_alloc_headroom(SCCP_MSG_SIZE,
 				       SCCP_MSG_HEADROOM, "sccp confirm");
+	if (!response) {
+		LOGP(DSCCP, LOGL_ERROR, "Failed to create SCCP Confirm.\n");
+		return NULL;
+	}
+
 	response->l2h = &response->data[0];
 
 	confirm = (struct sccp_connection_confirm *) msgb_put(response, sizeof(*confirm));
 
 	confirm->type = SCCP_MSG_TYPE_CC;
 	memcpy(&confirm->destination_local_reference,
-	       &connection->destination_local_reference,
-	       sizeof(connection->destination_local_reference));
+	       dst_ref, sizeof(*dst_ref));
 	memcpy(&confirm->source_local_reference,
-	       &connection->source_local_reference,
-	       sizeof(connection->source_local_reference));
+	       src_ref, sizeof(*src_ref));
 	confirm->proto_class = 2;
 	confirm->optional_start = 1;
 
 	optional_data = (u_int8_t *) msgb_put(response, 1);
 	optional_data[0] = SCCP_PNC_END_OF_OPTIONAL;
+	return response;
+}
+
+static int _sccp_send_connection_confirm(struct sccp_connection *connection)
+{
+	struct msgb *response;
+
+	if (assign_source_local_reference(connection) != 0)
+		return -1;
+
+	response = sccp_create_cc(&connection->source_local_reference,
+				  &connection->destination_local_reference);
+	if (!response)
+		return -1;
 
 	_send_msg(response);
 	_sccp_set_connection_state(connection, SCCP_CONNECTION_STATE_ESTABLISHED);
@@ -686,13 +740,13 @@ static int _sccp_send_connection_request(struct sccp_connection *connection,
 
 
 	if (msg && (msgb_l3len(msg) < 3 || msgb_l3len(msg) > 130)) {
-		DEBUGP(DSCCP, "Invalid amount of data... %d\n", msgb_l3len(msg));
+		LOGP(DSCCP, LOGL_ERROR, "Invalid amount of data... %d\n", msgb_l3len(msg));
 		return -1;
 	}
 
 	/* try to find a id */
 	if (assign_source_local_reference(connection) != 0) {
-		DEBUGP(DSCCP, "Assigning a local reference failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "Assigning a local reference failed.\n");
 		_sccp_set_connection_state(connection, SCCP_CONNECTION_STATE_SETUP_ERROR);
 		return -1;
 	}
@@ -736,34 +790,49 @@ static int _sccp_send_connection_request(struct sccp_connection *connection,
 	return 0;
 }
 
-static int _sccp_send_connection_data(struct sccp_connection *conn, struct msgb *_data)
+struct msgb *sccp_create_dt1(struct sccp_source_reference *dst_ref, uint8_t *inp_data, uint8_t len)
 {
 	struct msgb *msgb;
 	struct sccp_data_form1 *dt1;
 	u_int8_t *data;
-	int extra_size;
 
-	if (msgb_l3len(_data) < 2 || msgb_l3len(_data) > 256) {
-		DEBUGP(DSCCP, "data size too big, segmenting unimplemented.\n");
-		return -1;
-	}
-
-	extra_size = 1 + msgb_l3len(_data);
 	msgb = msgb_alloc_headroom(SCCP_MSG_SIZE,
 				   SCCP_MSG_HEADROOM, "sccp dt1");
+	if (!msgb) {
+		LOGP(DSCCP, LOGL_ERROR, "Failed to create DT1 msg.\n");
+		return NULL;
+	}
+
 	msgb->l2h = &msgb->data[0];
 
 	dt1 = (struct sccp_data_form1 *) msgb_put(msgb, sizeof(*dt1));
 	dt1->type = SCCP_MSG_TYPE_DT1;
-	memcpy(&dt1->destination_local_reference, &conn->destination_local_reference,
+	memcpy(&dt1->destination_local_reference, dst_ref,
 	       sizeof(struct sccp_source_reference));
 	dt1->segmenting = 0;
 
 	/* copy the data */
 	dt1->variable_start = 1;
-	data = msgb_put(msgb, extra_size);
-	data[0] = extra_size - 1;
-	memcpy(&data[1], _data->l3h, extra_size - 1);
+	data = msgb_put(msgb, 1 + len);
+	data[0] = len;
+	memcpy(&data[1], inp_data, len);
+
+	return msgb;
+}
+
+static int _sccp_send_connection_data(struct sccp_connection *conn, struct msgb *_data)
+{
+	struct msgb *msgb;
+
+	if (msgb_l3len(_data) < 2 || msgb_l3len(_data) > 256) {
+		LOGP(DSCCP, LOGL_ERROR, "data size too big, segmenting unimplemented.\n");
+		return -1;
+	}
+
+	msgb = sccp_create_dt1(&conn->destination_local_reference,
+			       _data->l3h, msgb_l3len(_data));
+	if (!msgb)
+		return -1;
 
 	_send_msg(msgb);
 	return 0;
@@ -792,7 +861,8 @@ static int _sccp_send_connection_it(struct sccp_connection *conn)
 	return 0;
 }
 
-static int _sccp_send_connection_released(struct sccp_connection *conn, int cause)
+struct msgb *sccp_create_rlsd(struct sccp_source_reference *src_ref,
+			      struct sccp_source_reference *dst_ref, int cause)
 {
 	struct msgb *msg;
 	struct sccp_connection_released *rel;
@@ -800,19 +870,36 @@ static int _sccp_send_connection_released(struct sccp_connection *conn, int caus
 
 	msg = msgb_alloc_headroom(SCCP_MSG_SIZE, SCCP_MSG_HEADROOM,
 				  "sccp: connection released");
+	if (!msg) {
+		LOGP(DSCCP, LOGL_ERROR, "Failed to allocate RLSD.\n");
+		return NULL;
+	}
+
 	msg->l2h = &msg->data[0];
 	rel = (struct sccp_connection_released *) msgb_put(msg, sizeof(*rel));
 	rel->type = SCCP_MSG_TYPE_RLSD;
 	rel->release_cause = cause;
 
 	/* copy the source references */
-	memcpy(&rel->destination_local_reference, &conn->destination_local_reference,
+	memcpy(&rel->destination_local_reference, dst_ref,
 	       sizeof(struct sccp_source_reference));
-	memcpy(&rel->source_local_reference, &conn->source_local_reference,
+	memcpy(&rel->source_local_reference, src_ref,
 	       sizeof(struct sccp_source_reference));
 
 	data = msgb_put(msg, 1);
 	data[0] = SCCP_PNC_END_OF_OPTIONAL;
+	return msg;
+}
+
+static int _sccp_send_connection_released(struct sccp_connection *conn, int cause)
+{
+	struct msgb *msg;
+
+	msg = sccp_create_rlsd(&conn->source_local_reference,
+			       &conn->destination_local_reference,
+			       cause);
+	if (!msg)
+		return -1;
 
 	_sccp_set_connection_state(conn, SCCP_CONNECTION_STATE_RELEASE);
 	_send_msg(msg);
@@ -840,14 +927,14 @@ static int _sccp_handle_connection_request(struct msgb *msgb)
 
 	cb = _find_ssn(result.called.ssn);
 	if (!cb || !cb->accept_cb) {
-		DEBUGP(DSCCP, "No routing for CR for called SSN: %u\n", result.called.ssn);
+		LOGP(DSCCP, LOGL_ERROR, "No routing for CR for called SSN: %u\n", result.called.ssn);
 		return -1;
 	}
 
 	/* check if the system wants this connection */
 	connection = talloc_zero(tall_sccp_ctx, struct sccp_connection);
 	if (!connection) {
-		DEBUGP(DSCCP, "Allocation failed\n");
+		LOGP(DSCCP, LOGL_ERROR, "Allocation failed\n");
 		return -1;
 	}
 
@@ -859,7 +946,7 @@ static int _sccp_handle_connection_request(struct msgb *msgb)
 	 * one....
 	 */
 	if (destination_local_reference_is_free(result.source_local_reference) != 0) {
-		DEBUGP(DSCCP, "Need to reject connection with existing reference\n");
+		LOGP(DSCCP, LOGL_ERROR, "Need to reject connection with existing reference\n");
 		_sccp_send_refuse(result.source_local_reference, SCCP_REFUSAL_SCCP_FAILURE);
 		talloc_free(connection);
 		return -1;
@@ -879,7 +966,7 @@ static int _sccp_handle_connection_request(struct msgb *msgb)
 	llist_add_tail(&connection->list, &sccp_connections);
 
 	if (_sccp_send_connection_confirm(connection) != 0) {
-		DEBUGP(DSCCP, "Sending confirm failed... no available source reference?\n");
+		LOGP(DSCCP, LOGL_ERROR, "Sending confirm failed... no available source reference?\n");
 
 		_sccp_send_refuse(result.source_local_reference, SCCP_REFUSAL_SCCP_FAILURE);
 		_sccp_set_connection_state(connection, SCCP_CONNECTION_STATE_REFUSED);
@@ -922,7 +1009,7 @@ static int _sccp_handle_connection_release_complete(struct msgb *msgb)
 	}
 
 
-	DEBUGP(DSCCP, "Release complete of unknown connection\n");
+	LOGP(DSCCP, LOGL_ERROR, "Release complete of unknown connection\n");
 	return -1;
 
 found:
@@ -950,7 +1037,7 @@ static int _sccp_handle_connection_dt1(struct msgb *msgb)
 		}
 	}
 
-	DEBUGP(DSCCP, "No connection found for dt1 data\n");
+	LOGP(DSCCP, LOGL_ERROR, "No connection found for dt1 data\n");
 	return -1;
 
 found:
@@ -1009,7 +1096,7 @@ static int _sccp_handle_connection_released(struct msgb *msgb)
 	}
 
 
-	DEBUGP(DSCCP, "Unknown connection was released.\n");
+	LOGP(DSCCP, LOGL_ERROR, "Unknown connection was released.\n");
 	return -1;
 
 	/* we have found a connection */
@@ -1021,7 +1108,7 @@ found:
 
 	/* generate a response */
 	if (_sccp_send_connection_release_complete(conn) != 0) {
-		DEBUGP(DSCCP, "Sending release confirmed failed\n");
+		LOGP(DSCCP, LOGL_ERROR, "Sending release confirmed failed\n");
 		return -1;
 	}
 
@@ -1046,7 +1133,7 @@ static int _sccp_handle_connection_refused(struct msgb *msgb)
 		}
 	}
 
-	DEBUGP(DSCCP, "Refused but no connection found\n");
+	LOGP(DSCCP, LOGL_ERROR, "Refused but no connection found\n");
 	return -1;
 
 found:
@@ -1079,7 +1166,7 @@ static int _sccp_handle_connection_confirm(struct msgb *msgb)
 		}
 	}
 
-	DEBUGP(DSCCP, "Confirmed but no connection found\n");
+	LOGP(DSCCP, LOGL_ERROR, "Confirmed but no connection found\n");
 	return -1;
 
 found:
@@ -1108,7 +1195,7 @@ int sccp_system_init(void (*outgoing)(struct msgb *data, void *ctx), void *ctx)
 int sccp_system_incoming(struct msgb *msgb)
 {
 	if (msgb_l2len(msgb) < 1 ) {
-		DEBUGP(DSCCP, "Too short packet\n");
+		LOGP(DSCCP, LOGL_ERROR, "Too short packet\n");
 		return -1;
 	}
 
@@ -1137,7 +1224,7 @@ int sccp_system_incoming(struct msgb *msgb)
 		return _sccp_handle_read(msgb);
 		break;
 	default:
-		DEBUGP(DSCCP, "unimplemented msg type: %d\n", type);
+		LOGP(DSCCP, LOGL_ERROR, "unimplemented msg type: %d\n", type);
 	};
 
 	return -1;
@@ -1148,7 +1235,7 @@ int sccp_connection_write(struct sccp_connection *connection, struct msgb *data)
 {
 	if (connection->connection_state < SCCP_CONNECTION_STATE_CONFIRM
 	    || connection->connection_state > SCCP_CONNECTION_STATE_ESTABLISHED) {
-		DEBUGP(DSCCP, "sccp_connection_write: Wrong connection state: %p %d\n",
+		LOGP(DSCCP, LOGL_ERROR, "sccp_connection_write: Wrong connection state: %p %d\n",
 		       connection, connection->connection_state);
 		return -1;
 	}
@@ -1165,7 +1252,7 @@ int sccp_connection_send_it(struct sccp_connection *connection)
 {
 	if (connection->connection_state < SCCP_CONNECTION_STATE_CONFIRM
 	    || connection->connection_state > SCCP_CONNECTION_STATE_ESTABLISHED) {
-		DEBUGP(DSCCP, "sccp_connection_write: Wrong connection state: %p %d\n",
+		LOGP(DSCCP, LOGL_ERROR, "sccp_connection_write: Wrong connection state: %p %d\n",
 		       connection, connection->connection_state);
 		return -1;
 	}
@@ -1178,7 +1265,7 @@ int sccp_connection_close(struct sccp_connection *connection, int cause)
 {
 	if (connection->connection_state < SCCP_CONNECTION_STATE_CONFIRM
 	    || connection->connection_state > SCCP_CONNECTION_STATE_ESTABLISHED) {
-		DEBUGPC(DSCCP, "Can not close the connection. It was never opened: %p %d\n",
+		LOGP(DSCCP, LOGL_ERROR, "Can not close the connection. It was never opened: %p %d\n",
 			connection, connection->connection_state);
 		return -1;
 	}
@@ -1190,7 +1277,7 @@ int sccp_connection_free(struct sccp_connection *connection)
 {
 	if (connection->connection_state > SCCP_CONNECTION_STATE_NONE
 	    && connection->connection_state < SCCP_CONNECTION_STATE_RELEASE_COMPLETE) {
-		DEBUGP(DSCCP, "The connection needs to be released before it is freed");
+		LOGP(DSCCP, LOGL_ERROR, "The connection needs to be released before it is freed");
 		return -1;
 	}
 
@@ -1318,6 +1405,9 @@ int sccp_parse_header(struct msgb *msg, struct sccp_parse_result *result)
 	case SCCP_MSG_TYPE_IT:
 		return _sccp_parse_it(msg, result);
 		break;
+	case SCCP_MSG_TYPE_ERR:
+		return _sccp_parse_err(msg, result);
+		break;
 	};
 
 	LOGP(DSCCP, LOGL_ERROR, "Unimplemented MSG Type: 0x%x\n", type);

openbsc/src/system_information.c

@@ -397,17 +397,17 @@ static int generate_si6(u_int8_t *output, struct gsm_bts *bts)
 
 static struct gsm48_si13_info si13_default = {
 	.cell_opts = {
-		.nmo 		= GPRS_NMO_III,
-		.t3168		= 1500,
-		.t3192		= 500,
+		.nmo 		= GPRS_NMO_II,
+		.t3168		= 2000,
+		.t3192		= 200,
 		.drx_timer_max	= 3,
 		.bs_cv_max	= 15,
-		.ext_info_present = 0,
+		.ext_info_present = 1,
 		.ext_info = {
 			/* The values below are just guesses ! */
 			.egprs_supported = 0,
 			.use_egprs_p_ch_req = 1,
-			.bep_period = 4,
+			.bep_period = 5,
 			.pfc_supported = 0,
 			.dtm_supported = 0,
 			.bss_paging_coordination = 0,
@@ -415,10 +415,10 @@ static struct gsm48_si13_info si13_default = {
 	},
 	.pwr_ctrl_pars = {
 		.alpha		= 10,	/* a = 1.0 */
-		.t_avg_w	= 25,
-		.t_avg_t	= 25,
+		.t_avg_w	= 16,
+		.t_avg_t	= 16,
 		.pc_meas_chan	= 0, 	/* downling measured on CCCH */
-		.n_avg_i	= 15,
+		.n_avg_i	= 8,
 	},
 	.bcch_change_mark	= 1,
 	.si_change_field	= 0,

openbsc/src/vty/buffer.c

@@ -65,11 +65,11 @@ struct buffer_data {
 #define BUFFER_DATA_FREE(D) talloc_free((D))
 
 /* Make new buffer. */
-struct buffer *buffer_new(size_t size)
+struct buffer *buffer_new(void *ctx, size_t size)
 {
 	struct buffer *b;
 
-	b = talloc_zero(tall_vty_ctx, struct buffer);
+	b = talloc_zero(ctx, struct buffer);
 
 	if (size)
 		b->size = size;
@@ -138,7 +138,7 @@ static struct buffer_data *buffer_add(struct buffer *b)
 {
 	struct buffer_data *d;
 
-	d = _talloc_zero(tall_vty_ctx,
+	d = _talloc_zero(b,
 			 offsetof(struct buffer_data, data[b->size]),
 			 "buffer_add");
 	if (!d)

openbsc/src/vty/vty.c

@@ -51,10 +51,10 @@ struct vty *vty_new()
 	if (!new)
 		goto out;
 
-	new->obuf = buffer_new(0);	/* Use default buffer size. */
+	new->obuf = buffer_new(new, 0);	/* Use default buffer size. */
 	if (!new->obuf)
 		goto out_new;
-	new->buf = _talloc_zero(tall_vty_ctx, VTY_BUFSIZ, "vty_new->buf");
+	new->buf = _talloc_zero(new, VTY_BUFSIZ, "vty_new->buf");
 	if (!new->buf)
 		goto out_obuf;
 
@@ -170,8 +170,7 @@ void vty_close(struct vty *vty)
 	/* Check configure. */
 	vty_config_unlock(vty);
 
-	/* FIXME: memory leak. We need to call telnet_close_client() but don't
-	 * have bfd */
+	/* VTY_CLOSED is handled by the telnet_interface */
 	vty_event(VTY_CLOSED, vty->fd, vty);
 
 	/* OK free vty. */
@@ -211,7 +210,7 @@ int vty_out(struct vty *vty, const char *format, ...)
 				else
 					size = size * 2;
 
-				p = talloc_realloc_size(tall_vty_ctx, p, size);
+				p = talloc_realloc_size(vty, p, size);
 				if (!p)
 					return -1;
 
@@ -358,7 +357,7 @@ static void vty_ensure(struct vty *vty, int length)
 {
 	if (vty->max <= length) {
 		vty->max *= 2;
-		vty->buf = talloc_realloc_size(tall_vty_ctx, vty->buf, vty->max);
+		vty->buf = talloc_realloc_size(vty, vty->buf, vty->max);
 		// FIXME: check return
 	}
 }
@@ -459,7 +458,7 @@ static void vty_hist_add(struct vty *vty)
 	/* Insert history entry. */
 	if (vty->hist[vty->hindex])
 		talloc_free(vty->hist[vty->hindex]);
-	vty->hist[vty->hindex] = talloc_strdup(tall_vty_ctx, vty->buf);
+	vty->hist[vty->hindex] = talloc_strdup(vty, vty->buf);
 
 	/* History index rotation. */
 	vty->hindex++;
@@ -916,7 +915,7 @@ static void vty_complete_command(struct vty *vty)
 		vty_backward_pure_word(vty);
 		vty_insert_word_overwrite(vty, matched[0]);
 		vty_self_insert(vty, ' ');
-		//talloc_free(matched[0]);
+		talloc_free(matched[0]);
 		break;
 	case CMD_COMPLETE_MATCH:
 		vty_prompt(vty);
@@ -924,8 +923,6 @@ static void vty_complete_command(struct vty *vty)
 		vty_backward_pure_word(vty);
 		vty_insert_word_overwrite(vty, matched[0]);
 		talloc_free(matched[0]);
-		vector_only_index_free(matched);
-		return;
 		break;
 	case CMD_COMPLETE_LIST_MATCH:
 		for (i = 0; matched[i] != NULL; i++) {
@@ -966,7 +963,7 @@ vty_describe_fold(struct vty *vty, int cmd_width,
 		return;
 	}
 
-	buf = _talloc_zero(tall_vty_ctx, strlen(desc->str) + 1, "describe_fold");
+	buf = _talloc_zero(vty, strlen(desc->str) + 1, "describe_fold");
 	if (!buf)
 		return;
 

openbsc/src/vty_interface.c

@@ -27,6 +27,7 @@
 #include <vty/vty.h>
 
 #include <arpa/inet.h>
+#include <netinet/ip.h>
 
 #include <osmocore/linuxlist.h>
 #include <openbsc/gsm_data.h>
@@ -44,6 +45,32 @@
 
 static struct gsm_network *gsmnet;
 
+static struct value_string gprs_ns_timer_strs[] = {
+	{ 0, "tns-block" },
+	{ 1, "tns-block-retries" },
+	{ 2, "tns-reset" },
+	{ 3, "tns-reset-retries" },
+	{ 4, "tns-test" },
+	{ 5, "tns-alive" },
+	{ 6, "tns-alive-retries" },
+	{ 0, NULL }
+};
+
+static struct value_string gprs_bssgp_cfg_strs[] = {
+	{ 0,	"blocking-timer" },
+	{ 1,	"blocking-retries" },
+	{ 2,	"unblocking-retries" },
+	{ 3,	"reset-timer" },
+	{ 4,	"reset-retries" },
+	{ 5,	"suspend-timer" },
+	{ 6,	"suspend-retries" },
+	{ 7,	"resume-timer" },
+	{ 8,	"resume-retries" },
+	{ 9,	"capability-update-timer" },
+	{ 10,	"capability-update-retries" },
+	{ 0,	NULL }
+};
+
 struct cmd_node net_node = {
 	GSMNET_NODE,
 	"%s(network)#",
@@ -321,10 +348,48 @@ static void config_write_trx_single(struct vty *vty, struct gsm_bts_trx *trx)
 		config_write_ts_single(vty, &trx->ts[i]);
 }
 
+static void config_write_bts_gprs(struct vty *vty, struct gsm_bts *bts)
+{
+	unsigned int i;
+	vty_out(vty, "  gprs mode %s%s", bts_gprs_mode_name(bts->gprs.mode),
+		VTY_NEWLINE);
+	if (bts->gprs.mode == BTS_GPRS_NONE)
+		return;
+
+	vty_out(vty, "  gprs routing area %u%s", bts->gprs.rac,
+		VTY_NEWLINE);
+	vty_out(vty, "  gprs cell bvci %u%s", bts->gprs.cell.bvci,
+		VTY_NEWLINE);
+	for (i = 0; i < ARRAY_SIZE(bts->gprs.cell.timer); i++)
+		vty_out(vty, "  gprs cell timer %s %u%s",
+			get_value_string(gprs_bssgp_cfg_strs, i),
+			bts->gprs.cell.timer[i], VTY_NEWLINE);
+	vty_out(vty, "  gprs nsei %u%s", bts->gprs.nse.nsei,
+		VTY_NEWLINE);
+	for (i = 0; i < ARRAY_SIZE(bts->gprs.nse.timer); i++)
+		vty_out(vty, "  gprs ns timer %s %u%s",
+			get_value_string(gprs_ns_timer_strs, i),
+			bts->gprs.nse.timer[i], VTY_NEWLINE);
+	for (i = 0; i < ARRAY_SIZE(bts->gprs.nsvc); i++) {
+		struct gsm_bts_gprs_nsvc *nsvc =
+					&bts->gprs.nsvc[i];
+		struct in_addr ia;
+
+		ia.s_addr = htonl(nsvc->remote_ip);
+		vty_out(vty, "  gprs nsvc %u nsvci %u%s", i,
+			nsvc->nsvci, VTY_NEWLINE);
+		vty_out(vty, "  gprs nsvc %u local udp port %u%s", i,
+			nsvc->local_port, VTY_NEWLINE);
+		vty_out(vty, "  gprs nsvc %u remote udp port %u%s", i,
+			nsvc->remote_port, VTY_NEWLINE);
+		vty_out(vty, "  gprs nsvc %u remote ip %s%s", i,
+			inet_ntoa(ia), VTY_NEWLINE);
+	}
+}
+
 static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts)
 {
 	struct gsm_bts_trx *trx;
-	int i;
 
 	vty_out(vty, " bts %u%s", bts->nr, VTY_NEWLINE);
 	vty_out(vty, "  type %s%s", btstype2str(bts->type), VTY_NEWLINE);
@@ -359,6 +424,8 @@ static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts)
 			bts->rach_ldavg_slots, VTY_NEWLINE);
 	if (bts->si_common.rach_control.cell_bar)
 		vty_out(vty, "  cell barred 1%s", VTY_NEWLINE);
+	if ((bts->si_common.rach_control.t2 & 0x4) == 0)
+		vty_out(vty, "  rach emergency call allowed 1%s", VTY_NEWLINE);
 	if (is_ipaccess_bts(bts)) {
 		vty_out(vty, "  ip.access unit_id %u %u%s",
 			bts->ip_access.site_id, bts->ip_access.bts_id, VTY_NEWLINE);
@@ -368,35 +435,12 @@ static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts)
 		vty_out(vty, "  oml e1 tei %u%s", bts->oml_tei, VTY_NEWLINE);
 	}
 
+	config_write_bts_gprs(vty, bts);
+
 	/* if we have a limit, write it */
 	if (bts->paging.free_chans_need >= 0)
 		vty_out(vty, "  paging free %d%s", bts->paging.free_chans_need, VTY_NEWLINE);
 
-	vty_out(vty, "  gprs mode %s%s", bts_gprs_mode_name(bts->gprs.mode),
-		VTY_NEWLINE);
-	if (bts->gprs.mode != BTS_GPRS_NONE) {
-		vty_out(vty, "  gprs routing area %u%s", bts->gprs.rac,
-			VTY_NEWLINE);
-		vty_out(vty, "  gprs cell bvci %u%s", bts->gprs.cell.bvci,
-			VTY_NEWLINE);
-		vty_out(vty, "  gprs nsei %u%s", bts->gprs.nse.nsei,
-			VTY_NEWLINE);
-		for (i = 0; i < ARRAY_SIZE(bts->gprs.nsvc); i++) {
-			struct gsm_bts_gprs_nsvc *nsvc =
-						&bts->gprs.nsvc[i];
-			struct in_addr ia;
-
-			ia.s_addr = htonl(nsvc->remote_ip);
-			vty_out(vty, "  gprs nsvc %u nsvci %u%s", i,
-				nsvc->nsvci, VTY_NEWLINE);
-			vty_out(vty, "  gprs nsvc %u local udp port %u%s", i,
-				nsvc->local_port, VTY_NEWLINE);
-			vty_out(vty, "  gprs nsvc %u remote udp port %u%s", i,
-				nsvc->remote_port, VTY_NEWLINE);
-			vty_out(vty, "  gprs nsvc %u remote ip %s%s", i,
-				inet_ntoa(ia), VTY_NEWLINE);
-		}
-	}
 
 	llist_for_each_entry(trx, &bts->trx_list, list)
 		config_write_trx_single(vty, trx);
@@ -480,6 +524,9 @@ static int config_write_net(struct vty *vty)
 		vty_out(vty, " bsc_token %s%s", gsmnet->bsc_token, VTY_NEWLINE);
 	vty_out(vty, " msc ip %s%s", gsmnet->msc_ip, VTY_NEWLINE);
 	vty_out(vty, " msc port %d%s", gsmnet->msc_port, VTY_NEWLINE);
+	vty_out(vty, " msc ip-tos %d%s", gsmnet->msc_prio, VTY_NEWLINE);
+	vty_out(vty, " timeout ping %d%s", gsmnet->ping_timeout, VTY_NEWLINE);
+	vty_out(vty, " timeout pong %d%s", gsmnet->pong_timeout, VTY_NEWLINE);
 
 	return CMD_SUCCESS;
 }
@@ -677,7 +724,7 @@ static void meas_rep_dump_vty(struct vty *vty, struct gsm_meas_rep *mr,
 	meas_rep_dump_uni_vty(vty, &mr->ul, prefix, "ul");
 }
 
-static void lchan_dump_vty(struct vty *vty, struct gsm_lchan *lchan)
+static void lchan_dump_full_vty(struct vty *vty, struct gsm_lchan *lchan)
 {
 	int idx;
 
@@ -712,37 +759,28 @@ static void lchan_dump_vty(struct vty *vty, struct gsm_lchan *lchan)
 	meas_rep_dump_vty(vty, &lchan->meas_rep[idx], "  ");
 }
 
-#if 0
-TODO: callref and remote callref of call must be resolved to get gsm_trans object
-static void call_dump_vty(struct vty *vty, struct gsm_call *call)
+static void lchan_dump_short_vty(struct vty *vty, struct gsm_lchan *lchan)
 {
-	vty_out(vty, "Call Type %u, State %u, Transaction ID %u%s",
-		call->type, call->state, call->transaction_id, VTY_NEWLINE);
+	struct gsm_meas_rep *mr;
+	int idx;
 
-	if (call->local_lchan) {
-		vty_out(vty, "Call Local Channel:%s", VTY_NEWLINE);
-		lchan_dump_vty(vty, call->local_lchan);
-	} else
-		vty_out(vty, "Call has no Local Channel%s", VTY_NEWLINE);
+	/* we want to report the last measurement report */
+	idx = calc_initial_idx(ARRAY_SIZE(lchan->meas_rep),
+			       lchan->meas_rep_idx, 1);
+	mr =  &lchan->meas_rep[idx];
 
-	if (call->remote_lchan) {
-		vty_out(vty, "Call Remote Channel:%s", VTY_NEWLINE);
-		lchan_dump_vty(vty, call->remote_lchan);
-	} else
-		vty_out(vty, "Call has no Remote Channel%s", VTY_NEWLINE);
-
-	if (call->called_subscr) {
-		vty_out(vty, "Called Subscriber:%s", VTY_NEWLINE);
-		subscr_dump_vty(vty, call->called_subscr);
-	} else
-		vty_out(vty, "Call has no Called Subscriber%s", VTY_NEWLINE);
+	vty_out(vty, "Lchan: %u Timeslot: %u TRX: %u BTS: %u Type: %s - L1 MS Power: %u dBm "
+		     "RXL-FULL-dl: %4d dBm RXL-FULL-ul: %4d dBm%s",
+		lchan->nr, lchan->ts->nr, lchan->ts->trx->nr,
+		lchan->ts->trx->bts->nr, gsm_lchant_name(lchan->type),
+		mr->ms_l1.pwr,
+		rxlev2dbm(mr->dl.full.rx_lev),
+		rxlev2dbm(mr->ul.full.rx_lev),
+		VTY_NEWLINE);
 }
-#endif
 
-DEFUN(show_lchan,
-      show_lchan_cmd,
-      "show lchan [bts_nr] [trx_nr] [ts_nr] [lchan_nr]",
-	SHOW_STR "Display information about a logical channel\n")
+static int lchan_summary(struct vty *vty, int argc, const char **argv,
+			 void (*dump_cb)(struct vty *, struct gsm_lchan *))
 {
 	struct gsm_network *net = gsmnet;
 	struct gsm_bts *bts;
@@ -787,7 +825,7 @@ DEFUN(show_lchan,
 			return CMD_WARNING;
 		}
 		lchan = &ts->lchan[lchan_nr];
-		lchan_dump_vty(vty, lchan);
+		dump_cb(vty, lchan);
 		return CMD_SUCCESS;
 	}
 	for (bts_nr = 0; bts_nr < net->num_bts; bts_nr++) {
@@ -801,7 +839,7 @@ DEFUN(show_lchan,
 					lchan = &ts->lchan[lchan_nr];
 					if (lchan->type == GSM_LCHAN_NONE)
 						continue;
-					lchan_dump_vty(vty, lchan);
+					dump_cb(vty, lchan);
 				}
 			}
 		}
@@ -810,6 +848,23 @@ DEFUN(show_lchan,
 	return CMD_SUCCESS;
 }
 
+
+DEFUN(show_lchan,
+      show_lchan_cmd,
+      "show lchan [bts_nr] [trx_nr] [ts_nr] [lchan_nr]",
+	SHOW_STR "Display information about a logical channel\n")
+{
+	return lchan_summary(vty, argc, argv, lchan_dump_full_vty);
+}
+
+DEFUN(show_lchan_summary,
+      show_lchan_summary_cmd,
+      "show lchan summary [bts_nr] [trx_nr] [ts_nr] [lchan_nr]",
+	SHOW_STR "Display a short summary about a logical channel\n")
+{
+	return lchan_summary(vty, argc, argv, lchan_dump_short_vty);
+}
+
 static void e1drv_dump_vty(struct vty *vty, struct e1inp_driver *drv)
 {
 	vty_out(vty, "E1 Input Driver %s%s", drv->name, VTY_NEWLINE);
@@ -1317,7 +1372,7 @@ DEFUN(cfg_net_pag_any_tch,
 
 DEFUN(cfg_net_msc_ip,
       cfg_net_msc_ip_cmd,
-      "msc ip IP",
+      "msc ip A.B.C.D",
       "Set the MSC/MUX IP address.")
 {
 	if (gsmnet->msc_ip)
@@ -1335,6 +1390,32 @@ DEFUN(cfg_net_msc_port,
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_net_msc_prio,
+      cfg_net_msc_prio_cmd,
+      "msc ip-tos <0-255>",
+      "Set the IP_TOS socket attribite")
+{
+	gsmnet->msc_prio = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_net_ping_time,
+      cfg_net_ping_time_cmd,
+      "timeout ping NR",
+      "Set the PING interval, negative for not sending PING")
+{
+	gsmnet->ping_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_net_pong_time,
+      cfg_net_pong_time_cmd,
+      "timeout pong NR",
+      "Set the time to wait for a PONG.")
+{
+	gsmnet->pong_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
 
 #define DECLARE_TIMER(number, doc) \
     DEFUN(cfg_net_T##number,					\
@@ -1642,6 +1723,20 @@ DEFUN(cfg_bts_cell_barred, cfg_bts_cell_barred_cmd,
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_bts_rach_ec_allowed, cfg_bts_rach_ec_allowed_cmd,
+      "rach emergency call allowed (0|1)",
+      "Should this cell allow emergency calls?")
+{
+	struct gsm_bts *bts = vty->index;
+
+	if (atoi(argv[0]) == 0)
+		bts->si_common.rach_control.t2 |= 0x4;
+	else
+		bts->si_common.rach_control.t2 &= ~0x4;
+
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_bts_ms_max_power, cfg_bts_ms_max_power_cmd,
       "ms max power <0-40>",
       "Maximum transmit power of the MS")
@@ -1789,13 +1884,61 @@ DEFUN(cfg_bts_gprs_nsvc_rip, cfg_bts_gprs_nsvc_rip_cmd,
 	return CMD_SUCCESS;
 }
 
-DEFUN(cfg_bts_pag_free, cfg_bts_pag_free_cmd,
-      "paging free FREE_NR",
-      "Only page when having a certain amount of free slots. -1 to disable")
+#define GPRS_TEXT "GPRS Packet Network\n"
+#define NS_TIMERS "(tns-block|tns-block-retries|tns-reset|tns-reset-retries|tns-test|tns-alive|tns-alive-retries)"
+#define NS_TIMERS_HELP	\
+	"(un)blocking Timer (Tns-block) timeout\n"		\
+	"(un)blocking Timer (Tns-block) number of retries\n"	\
+	"Reset Timer (Tns-reset) timeout\n"			\
+	"Reset Timer (Tns-reset) number of retries\n"		\
+	"Test Timer (Tns-test) timeout\n"			\
+
+DEFUN(cfg_bts_gprs_ns_timer, cfg_bts_gprs_ns_timer_cmd,
+	"gprs ns timer " NS_TIMERS " <0-255>",
+	GPRS_TEXT "Network Service\n"
+	"Network Service Timer\n"
+	NS_TIMERS_HELP "Timer Value\n")
 {
 	struct gsm_bts *bts = vty->index;
+	int idx = get_string_value(gprs_ns_timer_strs, argv[0]);
+	int val = atoi(argv[1]);
+
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
+		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (idx < 0 || idx >= ARRAY_SIZE(bts->gprs.nse.timer))
+		return CMD_WARNING;
+
+	bts->gprs.nse.timer[idx] = val;
+
+	return CMD_SUCCESS;
+}
+
+#define BSSGP_TIMERS "(blocking-timer|blocking-retries|unblocking-retries|reset-timer|reset-retries|suspend-timer|suspend-retries|resume-timer|resume-retries|capability-update-timer|capability-update-retries)"
+#define BSSGP_TIMERS_HELP	""
+
+DEFUN(cfg_bts_gprs_cell_timer, cfg_bts_gprs_cell_timer_cmd,
+	"gprs cell timer " BSSGP_TIMERS " <0-255>",
+	GPRS_TEXT "Cell / BSSGP\n"
+	"Cell/BSSGP Timer\n"
+	BSSGP_TIMERS_HELP "Timer Value\n")
+{
+	struct gsm_bts *bts = vty->index;
+	int idx = get_string_value(gprs_bssgp_cfg_strs, argv[0]);
+	int val = atoi(argv[1]);
+
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
+		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (idx < 0 || idx >= ARRAY_SIZE(bts->gprs.cell.timer))
+		return CMD_WARNING;
+
+	bts->gprs.cell.timer[idx] = val;
 
-	bts->paging.free_chans_need = atoi(argv[0]);
 	return CMD_SUCCESS;
 }
 
@@ -1826,6 +1969,15 @@ DEFUN(cfg_bts_gprs_mode, cfg_bts_gprs_mode_cmd,
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_bts_pag_free, cfg_bts_pag_free_cmd,
+      "paging free FREE_NR",
+      "Only page when having a certain amount of free slots. -1 to disable")
+{
+	struct gsm_bts *bts = vty->index;
+
+	bts->paging.free_chans_need = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
 
 /* per TRX configuration */
 DEFUN(cfg_trx,
@@ -2018,6 +2170,7 @@ int bsc_vty_init(struct gsm_network *net)
 	install_element(VIEW_NODE, &show_trx_cmd);
 	install_element(VIEW_NODE, &show_ts_cmd);
 	install_element(VIEW_NODE, &show_lchan_cmd);
+	install_element(VIEW_NODE, &show_lchan_summary_cmd);
 
 	install_element(VIEW_NODE, &show_e1drv_cmd);
 	install_element(VIEW_NODE, &show_e1line_cmd);
@@ -2070,6 +2223,9 @@ int bsc_vty_init(struct gsm_network *net)
 	install_element(GSMNET_NODE, &cfg_net_pag_any_tch_cmd);
 	install_element(GSMNET_NODE, &cfg_net_msc_ip_cmd);
 	install_element(GSMNET_NODE, &cfg_net_msc_port_cmd);
+	install_element(GSMNET_NODE, &cfg_net_msc_prio_cmd);
+	install_element(GSMNET_NODE, &cfg_net_ping_time_cmd);
+	install_element(GSMNET_NODE, &cfg_net_pong_time_cmd);
 
 	install_element(GSMNET_NODE, &cfg_bts_cmd);
 	install_node(&bts_node, config_write_bts);
@@ -2090,13 +2246,16 @@ int bsc_vty_init(struct gsm_network *net)
 	install_element(BTS_NODE, &cfg_bts_rach_nm_b_thresh_cmd);
 	install_element(BTS_NODE, &cfg_bts_rach_nm_ldavg_cmd);
 	install_element(BTS_NODE, &cfg_bts_cell_barred_cmd);
+	install_element(BTS_NODE, &cfg_bts_rach_ec_allowed_cmd);
 	install_element(BTS_NODE, &cfg_bts_ms_max_power_cmd);
 	install_element(BTS_NODE, &cfg_bts_per_loc_upd_cmd);
 	install_element(BTS_NODE, &cfg_bts_cell_resel_hyst_cmd);
 	install_element(BTS_NODE, &cfg_bts_rxlev_acc_min_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_mode_cmd);
+	install_element(BTS_NODE, &cfg_bts_gprs_ns_timer_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_rac_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_bvci_cmd);
+	install_element(BTS_NODE, &cfg_bts_gprs_cell_timer_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_nsei_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_nsvci_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_nsvc_lport_cmd);

openbsc/src/vty_interface_bsc.c

@@ -27,6 +27,7 @@
 #include <vty/vty.h>
 
 #include <openbsc/gsm_data.h>
+#include <openbsc/bsc_msc.h>
 #include <openbsc/vty.h>
 
 #include <sccp/sccp.h>
@@ -42,7 +43,7 @@ DEFUN(show_bsc, show_bsc_cmd, "show bsc",
 
 	vty_out(vty, "BSC Information%s", VTY_NEWLINE);
 	llist_for_each_entry(con, bsc_sccp_connections(), active_connections) {
-		vty_out(vty, " Connection: LCHAN: %p sec LCHAN: %p SCCP src: %d dest: %d%s",
+		vty_out(vty, " Connection: LCHAN: %p sec LCHAN: 0x%p SCCP src: 0x%x dest: 0x%x%s",
 			con->lchan, con->secondary_lchan,
 			con->sccp ? (int) sccp_src_ref_to_int(&con->sccp->source_local_reference) : -1,
 			con->sccp ? (int) sccp_src_ref_to_int(&con->sccp->destination_local_reference) : -1,
@@ -63,6 +64,24 @@ DEFUN(show_stats,
 	return CMD_SUCCESS;
 }
 
+DEFUN(show_msc,
+      show_msc_cmd,
+      "show msc connection",
+      SHOW_STR "Show the status of the MSC connection.")
+{
+	if (!gsmnet->msc_con) {
+		vty_out(vty, "The MSC is not yet configured.\n");
+		return CMD_WARNING;
+	}
+
+	vty_out(vty, "MSC on %s:%d is connected: %d%s\n",
+		gsmnet->msc_con->ip, gsmnet->msc_con->port,
+		gsmnet->msc_con->is_connected, VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+
 int bsc_vty_init_extra(struct gsm_network *net)
 {
 	gsmnet = net;
@@ -70,6 +89,7 @@ int bsc_vty_init_extra(struct gsm_network *net)
 	/* get runtime information */
 	install_element(VIEW_NODE, &show_bsc_cmd);
 	install_element(VIEW_NODE, &show_stats_cmd);
+	install_element(VIEW_NODE, &show_msc_cmd);
 
 	return 0;
 }

openbsc/src/vty_interface_layer3.c

@@ -58,7 +58,7 @@ static int dummy_config_write(struct vty *v)
 
 static struct buffer *argv_to_buffer(int argc, const char *argv[], int base)
 {
-	struct buffer *b = buffer_new(1024);
+	struct buffer *b = buffer_new(NULL, 1024);
 	int i;
 
 	if (!b)

openbsc/tests/bsc-nat/Makefile.am

@@ -13,5 +13,5 @@ bsc_nat_test_SOURCES = bsc_nat_test.c \
 			$(top_srcdir)/src/mgcp/mgcp_protocol.c \
 			$(top_srcdir)/src/mgcp/mgcp_network.c \
 			$(top_srcdir)/src/bssap.c
-bsc_nat_test_LDADD = $(top_builddir)/src/libbsc.a $(top_builddir)/src/libsccp.a $(LIBOSMOCORE_LIBS)
+bsc_nat_test_LDADD = $(top_builddir)/src/libbsc.a $(top_builddir)/src/libsccp.a $(LIBOSMOCORE_LIBS) -lrt
 

openbsc/tests/bsc-nat/bsc_nat_test.c

@@ -96,12 +96,40 @@ static const u_int8_t connnection_it[] = {
 	0x00, 0x00, 0x00, 0x00,
 };
 
+/* error in both directions */
+static const u_int8_t proto_error[] = {
+	0x00, 0x05, 0xfd,
+	0x0f, 0x22, 0x33, 0x44, 0x00,
+};
+
 /* MGCP wrap... */
 static const u_int8_t mgcp_msg[] = {
 	0x00, 0x03, 0xfc,
 	0x20, 0x20, 0x20,
 };
 
+/* location updating request */
+static const u_int8_t bss_lu[] = {
+	0x00, 0x2e, 0xfd,
+	0x01, 0x91, 0x45, 0x14, 0x02, 0x02, 0x04, 0x02,
+	0x42, 0xfe, 0x0f, 0x21, 0x00, 0x1f, 0x57, 0x05,
+	0x08, 0x00, 0x72, 0xf4, 0x80, 0x20, 0x14, 0xc3,
+	0x50, 0x17, 0x12, 0x05, 0x08, 0x70, 0x72, 0xf4,
+	0x80, 0xff, 0xfe, 0x30, 0x08, 0x29, 0x44, 0x50,
+	0x12, 0x03, 0x24, 0x01, 0x95, 0x00
+};
+
+/* paging response */
+static const uint8_t pag_resp[] = {
+	0x00, 0x2c, 0xfd, 0x01, 0xe5, 0x68,
+	0x14, 0x02, 0x02, 0x04, 0x02, 0x42, 0xfe, 0x0f,
+	0x1f, 0x00, 0x1d, 0x57, 0x05, 0x08, 0x00, 0x72,
+	0xf4, 0x80, 0x20, 0x16, 0xc3, 0x50, 0x17, 0x10,
+	0x06, 0x27, 0x01, 0x03, 0x30, 0x18, 0x96, 0x08,
+	0x29, 0x26, 0x30, 0x32, 0x11, 0x42, 0x01, 0x19,
+	0x00
+};
+
 struct filter_result {
 	const u_int8_t *data;
 	const u_int16_t length;
@@ -176,6 +204,19 @@ static const struct filter_result results[] = {
 		.dir = DIR_MSC,
 		.result = 0,
 	},
+	{
+		.data = proto_error,
+		.length = ARRAY_SIZE(proto_error),
+		.dir = DIR_BSC,
+		.result = 0,
+	},
+	{
+		.data = proto_error,
+		.length = ARRAY_SIZE(proto_error),
+		.dir = DIR_MSC,
+		.result = 0,
+	},
+
 };
 
 static void test_filter(void)
@@ -232,10 +273,10 @@ static void copy_to_msg(struct msgb *msg, const u_int8_t *data, unsigned int len
 /* test conn tracking once */
 static void test_contrack()
 {
-	int rc;
 	struct bsc_nat *nat;
 	struct bsc_connection *con;
 	struct sccp_connections *con_found;
+	struct sccp_connections *rc_con;
 	struct bsc_nat_parsed *parsed;
 	struct msgb *msg;
 
@@ -248,21 +289,25 @@ static void test_contrack()
 	/* 1.) create a connection */
 	copy_to_msg(msg, bsc_cr, sizeof(bsc_cr));
 	parsed = bsc_nat_parse(msg);
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 	if (con_found != NULL) {
 		fprintf(stderr, "Con should not exist %p\n", con_found);
 		abort();
 	}
-	rc = create_sccp_src_ref(con, msg, parsed);
-	if (rc != 0) {
+	rc_con = create_sccp_src_ref(con, parsed);
+	if (!rc_con) {
 		fprintf(stderr, "Failed to create a ref\n");
 		abort();
 	}
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 	if (!con_found || con_found->bsc != con) {
 		fprintf(stderr, "Failed to find the con: %p\n", con_found);
 		abort();
 	}
+	if (con_found != rc_con) {
+		fprintf(stderr, "Failed to find the right connection.\n");
+		abort();
+	}
 	if (memcmp(msg->data, bsc_cr_patched, sizeof(bsc_cr_patched)) != 0) {
 		fprintf(stderr, "Failed to patch the BSC CR msg.\n");
 		abort();
@@ -282,7 +327,7 @@ static void test_contrack()
 	/* 3.) send some data */
 	copy_to_msg(msg, bsc_dtap, sizeof(bsc_dtap));
 	parsed = bsc_nat_parse(msg);
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 	VERIFY(con_found, con, msg, bsc_dtap_patched, "BSC DTAP");
 
 	/* 4.) receive some data */
@@ -300,7 +345,7 @@ static void test_contrack()
 	/* 6.) confirm the connection close */
 	copy_to_msg(msg, bsc_rlc, sizeof(bsc_rlc));
 	parsed = bsc_nat_parse(msg);
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 	if (!con_found || con_found->bsc != con) {
 		fprintf(stderr, "Failed to find the con: %p\n", con_found);
 		abort();
@@ -314,7 +359,7 @@ static void test_contrack()
 
 	copy_to_msg(msg, bsc_rlc, sizeof(bsc_rlc));
 	parsed = bsc_nat_parse(msg);
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 
 	/* verify that it is gone */
 	if (con_found != NULL) {
@@ -376,6 +421,8 @@ static void test_paging(void)
 
 static void test_mgcp_ass_tracking(void)
 {
+	struct bsc_connection *bsc;
+	struct bsc_nat *nat;
 	struct sccp_connections con;
 	struct bsc_nat_parsed *parsed;
 	struct msgb *msg;
@@ -383,6 +430,14 @@ static void test_mgcp_ass_tracking(void)
 	fprintf(stderr, "Testing MGCP.\n");
 	memset(&con, 0, sizeof(con));
 
+	nat = bsc_nat_alloc();
+	nat->bsc_endpoints = talloc_zero_array(nat,
+					       struct bsc_endpoint,
+					       33);
+	bsc = bsc_connection_alloc(nat);
+	bsc->cfg = bsc_config_alloc(nat, "foo", 2323);
+	con.bsc = bsc;
+
 	msg = msgb_alloc(4096, "foo");
 	copy_to_msg(msg, ass_cmd, sizeof(ass_cmd));
 	parsed = bsc_nat_parse(msg);
@@ -402,11 +457,13 @@ static void test_mgcp_ass_tracking(void)
 	}
 	talloc_free(parsed);
 
-	bsc_mgcp_clear(&con);
+	bsc_mgcp_dlcx(&con);
 	if (con.bsc_timeslot != -1 || con.msc_timeslot != -1) {
 		fprintf(stderr, "Clearing should remove the mapping.\n");
 		abort();
 	}
+
+	talloc_free(nat);
 }
 
 /* test the code to find a given connection */
@@ -509,6 +566,135 @@ static void test_mgcp_parse(void)
 	}
 }
 
+struct cr_filter {
+	const u_int8_t *data;
+	int length;
+	int result;
+	int contype;
+
+	const char *bsc_imsi_allow;
+	const char *bsc_imsi_deny;
+	const char *nat_imsi_deny;
+};
+
+static struct cr_filter cr_filter[] = {
+	{
+		.data = bssmap_cr,
+		.length = sizeof(bssmap_cr),
+		.result = 0,
+		.contype = NAT_CON_TYPE_CM_SERV_REQ,
+	},
+	{
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = 0,
+		.contype = NAT_CON_TYPE_LU,
+	},
+	{
+		.data = pag_resp,
+		.length = sizeof(pag_resp),
+		.result = 0,
+		.contype = NAT_CON_TYPE_PAG_RESP,
+	},
+	{
+		/* nat deny is before blank/null BSC */
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = -3,
+		.nat_imsi_deny = "[0-9]*",
+		.contype = NAT_CON_TYPE_LU,
+	},
+	{
+		/* BSC allow is before NAT deny */
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = 0,
+		.nat_imsi_deny = "[0-9]*",
+		.bsc_imsi_allow = "2440[0-9]*",
+		.contype = NAT_CON_TYPE_LU,
+	},
+	{
+		/* BSC allow is before NAT deny */
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = 0,
+		.bsc_imsi_allow = "[0-9]*",
+		.nat_imsi_deny = "[0-9]*",
+		.contype = NAT_CON_TYPE_LU,
+	},
+	{
+		/* filter as deny is first */
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = -2,
+		.bsc_imsi_deny = "[0-9]*",
+		.bsc_imsi_allow = "[0-9]*",
+		.nat_imsi_deny = "[0-9]*",
+		.contype = NAT_CON_TYPE_LU,
+	},
+
+};
+
+static void test_cr_filter()
+{
+	int i, res, contype;
+	struct msgb *msg = msgb_alloc(4096, "test_cr_filter");
+	struct bsc_nat_parsed *parsed;
+	struct bsc_nat_acc_lst *nat_lst, *bsc_lst;
+	struct bsc_nat_acc_lst_entry *nat_entry, *bsc_entry;
+
+	struct bsc_nat *nat = bsc_nat_alloc();
+	struct bsc_connection *bsc = bsc_connection_alloc(nat);
+	bsc->cfg = bsc_config_alloc(nat, "foo", 1234);
+	bsc->cfg->acc_lst_name = "bsc";
+	nat->acc_lst_name = "nat";
+
+	nat_lst = bsc_nat_acc_lst_get(nat, "nat");
+	bsc_lst = bsc_nat_acc_lst_get(nat, "bsc");
+
+	bsc_entry = bsc_nat_acc_lst_entry_create(bsc_lst);
+	nat_entry = bsc_nat_acc_lst_entry_create(nat_lst);
+
+	for (i = 0; i < ARRAY_SIZE(cr_filter); ++i) {
+		msgb_reset(msg);
+		copy_to_msg(msg, cr_filter[i].data, cr_filter[i].length);
+
+		nat_lst = bsc_nat_acc_lst_get(nat, "nat");
+		bsc_lst = bsc_nat_acc_lst_get(nat, "bsc");
+
+		bsc_parse_reg(nat_entry, &nat_entry->imsi_deny_re, &nat_entry->imsi_deny,
+			      cr_filter[i].nat_imsi_deny ? 1 : 0,
+			      &cr_filter[i].nat_imsi_deny);
+		bsc_parse_reg(bsc_entry, &bsc_entry->imsi_allow_re, &bsc_entry->imsi_allow,
+			      cr_filter[i].bsc_imsi_allow ? 1 : 0,
+			      &cr_filter[i].bsc_imsi_allow);
+		bsc_parse_reg(bsc_entry, &bsc_entry->imsi_deny_re, &bsc_entry->imsi_deny,
+			      cr_filter[i].bsc_imsi_deny ? 1 : 0,
+			      &cr_filter[i].bsc_imsi_deny);
+
+		parsed = bsc_nat_parse(msg);
+		if (!parsed) {
+			fprintf(stderr, "FAIL: Failed to parse the message\n");
+			abort();
+		}
+
+		res = bsc_nat_filter_sccp_cr(bsc, msg, parsed, &contype);
+		if (res != cr_filter[i].result) {
+			fprintf(stderr, "FAIL: Wrong result %d for test %d.\n", res, i);
+			abort();
+		}
+
+		if (contype != cr_filter[i].contype) {
+			fprintf(stderr, "FAIL: Wrong contype %d for test %d.\n", res, contype);
+			abort();
+		}
+
+		talloc_free(parsed);
+	}
+
+	msgb_free(msg);
+}
+
 int main(int argc, char **argv)
 {
 	struct log_target *stderr_target;
@@ -525,6 +711,7 @@ int main(int argc, char **argv)
 	test_mgcp_find();
 	test_mgcp_rewrite();
 	test_mgcp_parse();
+	test_cr_filter();
 	return 0;
 }
 

openbsc/tests/sccp/sccp_test.c

@@ -264,6 +264,10 @@ static const u_int8_t it_test[] = {
 0x10, 0x01, 0x07, 
 0x94, 0x01, 0x04, 0x00, 0x02, 0x00, 0x00, 0x00 };
 
+static const u_int8_t proto_err[] = {
+0x0f, 0x0c, 0x04, 0x00, 0x00,
+};
+
 static const struct sccp_parse_header_result parse_result[] = {
 	{
 		.msg_type	= SCCP_MSG_TYPE_IT,
@@ -287,6 +291,21 @@ static const struct sccp_parse_header_result parse_result[] = {
 		.input		= it_test,
 		.input_len	= sizeof(it_test),
 	},
+	{
+		.msg_type	= SCCP_MSG_TYPE_ERR,
+		.wanted_len	= 0,
+		.src_ssn	= -1,
+		.dst_ssn	= -1,
+		.has_src_ref	= 0,
+		.has_dst_ref	= 1,
+		.dst_ref	= {
+			.octet1 = 0x0c,
+			.octet2 = 0x04,
+			.octet3 = 0x00,
+		},
+		.input		= proto_err,
+		.input_len	= sizeof(proto_err),
+	},
 };
 
 
@@ -777,7 +796,7 @@ static void test_sccp_parsing(void)
 
 		memset(&result, 0, sizeof(result));
 		if (sccp_parse_header(msg, &result) != 0) {
-			fprintf(stderr, "Failed to parse test: %d\n", current_test);
+			fprintf(stderr, "Failed to sccp parse test: %d\n", current_test);
 		} else {
 			if (parse_result[current_test].wanted_len != result.data_len) {
 				fprintf(stderr, "Unexpected data length.\n");